safeuploads 2.1.0__tar.gz → 2.2.0__tar.gz

{safeuploads-2.1.0 → safeuploads-2.2.0}/.agents/skills/safeuploads-library/references/testing.md

@@ -9,7 +9,7 @@
 - Markers are declared in `pyproject.toml` (`unit`, `integration`, `slow`, `performance`, `fuzz`) and run with `--strict-markers`; mark a new test accordingly.
 - Skips need `reason=`.
 - Coverage is branch coverage with `fail_under = 90`; it is a ratchet, raise it when coverage rises and never lower it.
-- Tests are deterministic and offline; a performance test asserts a generous bound, never an exact time.
+- Tests are deterministic and offline; a performance test asserts a generous bound, never an exact time, and is deselected by default (`addopts` in `pyproject.toml`), so run it with `-m performance`.
 - Do not mock a validator to test the orchestrator's decision; run the real one on a small payload.
 
 ## Fuzzing
@@ -18,6 +18,7 @@
 
 ```bash
 uv run pytest tests/validators -v
-uv run pytest -m "not performance and not fuzz"
+uv run pytest -m "not fuzz"
+uv run pytest -m performance
 uv run pytest --cov=safeuploads --cov-report=term-missing
 ```

safeuploads-2.2.0/.github/workflows/mirror.yml

@@ -0,0 +1,41 @@
+name: Mirror to GitLab
+
+on:
+  push:
+
+concurrency:
+  group: gitlab-mirror
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Push full mirror to GitLab
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
+        # Credentials go in per-host Authorization headers passed through
+        # GIT_CONFIG_* environment variables, so they never appear in a
+        # command line, a remote URL or the mirror's stored git config.
+        run: |
+          set -euo pipefail
+          github_auth="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 -w0)"
+          gitlab_auth="$(printf 'oauth2:%s' "$GITLAB_TOKEN" | base64 -w0)"
+          echo "::add-mask::${github_auth}"
+          echo "::add-mask::${gitlab_auth}"
+          export GIT_CONFIG_COUNT=2
+          export GIT_CONFIG_KEY_0="http.https://github.com/.extraheader"
+          export GIT_CONFIG_VALUE_0="Authorization: Basic ${github_auth}"
+          export GIT_CONFIG_KEY_1="http.https://gitlab.com/.extraheader"
+          export GIT_CONFIG_VALUE_1="Authorization: Basic ${gitlab_auth}"
+          mirror_dir="$RUNNER_TEMP/safeuploads.git"
+          git clone --mirror \
+            "https://github.com/${GITHUB_REPOSITORY}.git" "$mirror_dir"
+          cd "$mirror_dir"
+          git remote set-url --push origin \
+            "https://gitlab.com/endurain-project/safeuploads.git"
+          git push --mirror

{safeuploads-2.1.0 → safeuploads-2.2.0}/.github/workflows/publish-safeuploads.yml

@@ -70,6 +70,11 @@ jobs:
             exit 1
           fi
 
+      # python-magic needs the libmagic shared library at import time; install it
+      # explicitly instead of relying on the runner image, as the test workflows do.
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libmagic1
+
       # The full gate runs on every PR, but a tag can point anywhere in history,
       # so re-run it here: a release must never ship code that does not pass.
       - name: Sync dependencies

{safeuploads-2.1.0 → safeuploads-2.2.0}/.gitignore

@@ -15,6 +15,7 @@ site/
 # Python
 __pycache__
 .ruff_cache/
+.mypy_cache/
 .hypothesis/
 
 # Tests

{safeuploads-2.1.0 → safeuploads-2.2.0}/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to this project are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.2.0] - 2026-11-05
+
+### Added
+
+- `ConfigValidationIssue`, exported from `safeuploads` and `safeuploads.exceptions`: the record `validate_instance()` and `validate_configuration()` return and `FileSecurityConfigurationError.errors` carries. It is the same dataclass under a name that does not suggest an exception.
+
+### Deprecated
+
+- `ConfigValidationError` is a deprecated alias of `ConfigValidationIssue` and will be removed in 3.0. Accessing or importing it from `safeuploads` or `safeuploads.exceptions` emits a `DeprecationWarning`; it is no longer in `safeuploads.__all__`. It was never an exception, so `except ConfigValidationError` could not catch anything.
+
+### Changed
+
+- Development: the dev dependency `httpx` is replaced by `httpx2`, which Starlette's `TestClient` now expects.
+- Development: performance tests (`-m performance`) are deselected by default; run them with `pytest -m performance`.
+- CI: the publish workflow installs `libmagic1` explicitly, and the GitLab mirror passes its tokens as HTTP authorization headers through `GIT_CONFIG_*` environment variables instead of embedding them in remote URLs.
+
 ## [2.1.0] - 2026-11-05
 
 ### Added

{safeuploads-2.1.0 → safeuploads-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: safeuploads
-Version: 2.1.0
+Version: 2.2.0
 Summary: A comprehensive file security system for validating uploads and preventing attacks
 Author-email: João Vitória Silva <joao@endurain.com>
 License: MIT

{safeuploads-2.1.0 → safeuploads-2.2.0}/docs/security/architecture.md

@@ -373,7 +373,7 @@ Exception
 All `FileSecurityError` subclasses carry an `error_code` from
 `ErrorCode` for machine-readable classification.
 `FileSecurityConfigurationError` is separate and exposes its
-`errors` list instead. When no code is passed, the default is:
+`errors` list of `ConfigValidationIssue` records instead. When no code is passed, the default is:
 
 | Exception | Default `ErrorCode` |
 |---|---|

{safeuploads-2.1.0 → safeuploads-2.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "safeuploads"
-version = "2.1.0"
+version = "2.2.0"
 description = "A comprehensive file security system for validating uploads and preventing attacks"
 authors = [
     {name = "João Vitória Silva",email = "joao@endurain.com"}
@@ -27,7 +27,7 @@ dev = [
     "ty>=0.0.83",
     "types-defusedxml",
     # HTTP stack for the FastAPI multipart integration test
-    "httpx>=0.27,<1.0",
+    "httpx2>=2.16,<3.0",
     "python-multipart>=0.0.9,<1.0",
 ]
 docs = [
@@ -118,6 +118,10 @@ addopts = [
     "--strict-markers",
     "--strict-config",
     "-ra",
+    # Benchmarks assert wall-clock bounds that depend on the machine;
+    # run them explicitly with `pytest -m performance`.
+    "-m",
+    "not performance",
     "--cov=safeuploads",
     "--cov-report=term-missing",
     "--cov-report=html",

{safeuploads-2.1.0 → safeuploads-2.2.0}/safeuploads/__init__.py

@@ -6,6 +6,7 @@ validating uploads and preventing attacks.
 """
 
 from importlib.metadata import PackageNotFoundError, version
+from typing import TYPE_CHECKING
 
 from .audit import (
     AuditEvent,
@@ -28,7 +29,7 @@ from .enums import (
 )
 from .exceptions import (
     CompressionSecurityError,
-    ConfigValidationError,
+    ConfigValidationIssue,
     ContentThreatError,
     ErrorCode,
     ExtensionSecurityError,
@@ -75,6 +76,16 @@ from .validators import (
     XmlSecurityValidator,
 )
 
+if TYPE_CHECKING:
+    # Deprecated alias, resolved by ``__getattr__`` at runtime
+    from .exceptions import ConfigValidationError as ConfigValidationError
+else:
+    from .exceptions import _resolve_deprecated
+
+    def __getattr__(name: str) -> object:
+        """Resolve deprecated package attributes (PEP 562)."""
+        return _resolve_deprecated(__name__, name)
+
 # Configuration is validated explicitly rather than at import
 # time: FileValidator validates its config on construction, and
 # callers can invoke FileSecurityConfig.validate_and_report() or
@@ -95,7 +106,7 @@ __all__ = [
     "SeekableFile",
     "UploadFileProtocol",
     # Exceptions
-    "ConfigValidationError",
+    "ConfigValidationIssue",
     "FileSecurityConfigurationError",
     "ErrorCode",
     "FileSecurityError",

{safeuploads-2.1.0 → safeuploads-2.2.0}/safeuploads/config.py

@@ -11,7 +11,7 @@ from .enums import (
     DangerousExtensionCategory,
     UnicodeAttackCategory,
 )
-from .exceptions import ConfigValidationError, FileSecurityConfigurationError
+from .exceptions import ConfigValidationIssue, FileSecurityConfigurationError
 from .utils import bytes_to_mb
 
 logger = logging.getLogger(__name__)
@@ -23,9 +23,9 @@ def _config_error(
     component: str,
     recommendation: str,
     severity: str = "error",
-) -> ConfigValidationError:
+) -> ConfigValidationIssue:
     """
-    Build a ConfigValidationError with a default severity.
+    Build a ConfigValidationIssue with a default severity.
 
     Centralizes construction so the many validation branches
     share one call shape instead of repeating every field.
@@ -38,9 +38,9 @@ def _config_error(
         severity: Severity level ('error', 'warning', 'info').
 
     Returns:
-        Populated ConfigValidationError instance.
+        Populated ConfigValidationIssue instance.
     """
-    return ConfigValidationError(
+    return ConfigValidationIssue(
         error_type=error_type,
         message=message,
         severity=severity,
@@ -451,7 +451,7 @@ class FileSecurityConfig:
         return None
 
     @classmethod
-    def validate_configuration(cls) -> list[ConfigValidationError]:
+    def validate_configuration(cls) -> list[ConfigValidationIssue]:
         """
         Validate the class-level default configuration.
 
@@ -460,7 +460,7 @@ class FileSecurityConfig:
         """
         return cls._collect_errors(cls, cls.limits)
 
-    def validate_instance(self) -> list[ConfigValidationError]:
+    def validate_instance(self) -> list[ConfigValidationIssue]:
         """
         Validate this instance's configuration.
 
@@ -479,7 +479,7 @@ class FileSecurityConfig:
         cls,
         config: "FileSecurityConfig | type[FileSecurityConfig]",
         limits: SecurityLimits,
-    ) -> list[ConfigValidationError]:
+    ) -> list[ConfigValidationIssue]:
         """
         Run all validation routines for the given configuration.
 
@@ -495,7 +495,7 @@ class FileSecurityConfig:
         Returns:
             List of detected validation errors.
         """
-        errors: list[ConfigValidationError] = []
+        errors: list[ConfigValidationIssue] = []
 
         # Validate limit types first so the range checks below
         # never compare a wrongly typed value.
@@ -530,7 +530,7 @@ class FileSecurityConfig:
     @staticmethod
     def _validate_limit_types(
         limits: SecurityLimits,
-    ) -> list[ConfigValidationError]:
+    ) -> list[ConfigValidationIssue]:
         """
         Validate that every limit holds a value of its declared type.
 
@@ -577,7 +577,7 @@ class FileSecurityConfig:
     @staticmethod
     def _validate_file_size_limits(
         limits: SecurityLimits,
-    ) -> list[ConfigValidationError]:
+    ) -> list[ConfigValidationIssue]:
         """
         Validate the provided file size limits.
 
@@ -708,7 +708,7 @@ class FileSecurityConfig:
     @staticmethod
     def _validate_streaming_limits(
         limits: SecurityLimits,
-    ) -> list[ConfigValidationError]:
+    ) -> list[ConfigValidationIssue]:
         """
         Validate streaming, resource and content scan limits.
 
@@ -788,7 +788,7 @@ class FileSecurityConfig:
     @staticmethod
     def _validate_mime_configurations(
         config: "FileSecurityConfig | type[FileSecurityConfig]",
-    ) -> list[ConfigValidationError]:
+    ) -> list[ConfigValidationIssue]:
         """
         Validate MIME type configurations.
 
@@ -876,7 +876,7 @@ class FileSecurityConfig:
     @staticmethod
     def _validate_extension_configurations(
         config: "FileSecurityConfig | type[FileSecurityConfig]",
-    ) -> list[ConfigValidationError]:
+    ) -> list[ConfigValidationIssue]:
         """
         Validate file extension configurations.
 
@@ -1028,7 +1028,7 @@ class FileSecurityConfig:
     @staticmethod
     def _validate_compression_settings(
         limits: SecurityLimits,
-    ) -> list[ConfigValidationError]:
+    ) -> list[ConfigValidationIssue]:
         """
         Validate the provided compression-related limits.
 
@@ -1240,7 +1240,7 @@ class FileSecurityConfig:
         return errors
 
     @classmethod
-    def _validate_enum_consistency(cls) -> list[ConfigValidationError]:
+    def _validate_enum_consistency(cls) -> list[ConfigValidationIssue]:
         """
         Validate enum categories for emptiness and overlaps.
 
@@ -1345,7 +1345,7 @@ class FileSecurityConfig:
     @staticmethod
     def _validate_cross_dependencies(
         config: "FileSecurityConfig | type[FileSecurityConfig]",
-    ) -> list[ConfigValidationError]:
+    ) -> list[ConfigValidationIssue]:
         """
         Validate cross-field configuration constraints.
 
@@ -1452,7 +1452,7 @@ class FileSecurityConfig:
 
     @staticmethod
     def _report_errors(
-        errors: list[ConfigValidationError], strict: bool
+        errors: list[ConfigValidationIssue], strict: bool
     ) -> None:
         """
         Log validation issues and optionally raise.

{safeuploads-2.1.0 → safeuploads-2.2.0}/safeuploads/exceptions.py

@@ -1,7 +1,9 @@
 """File security exception classes and error codes."""
 
+import warnings
 from dataclasses import dataclass
 from enum import StrEnum
+from typing import TYPE_CHECKING
 
 # ============================================================================
 # Configuration Validation
@@ -9,10 +11,14 @@ from enum import StrEnum
 
 
 @dataclass
-class ConfigValidationError:
+class ConfigValidationIssue:
     """
     Configuration validation issue with severity and recommendation.
 
+    A plain record, not an exception: ``validate_instance()`` and
+    ``validate_configuration()`` return a list of them, and
+    ``FileSecurityConfigurationError.errors`` carries them.
+
     Attributes:
         error_type: Type of the validation error.
         message: Human-readable error message.
@@ -28,18 +34,59 @@ class ConfigValidationError:
     recommendation: str = ""
 
 
+_DEPRECATED_NAMES = {"ConfigValidationError": "ConfigValidationIssue"}
+
+if TYPE_CHECKING:
+    # Deprecated alias; at runtime ``__getattr__`` resolves it with a
+    # DeprecationWarning. Removed in 3.0.
+    ConfigValidationError = ConfigValidationIssue
+else:
+
+    def _resolve_deprecated(module: str, name: str) -> object:
+        """
+        Return the object a deprecated name stands for, with a warning.
+
+        Args:
+            module: Name of the module the attribute was looked up on.
+            name: Attribute name being looked up.
+
+        Returns:
+            The object that replaces the deprecated name.
+
+        Raises:
+            AttributeError: ``name`` is not a deprecated name.
+        """
+        new_name = _DEPRECATED_NAMES.get(name)
+        if new_name is None:
+            raise AttributeError(
+                f"module {module!r} has no attribute {name!r}"
+            )
+        warnings.warn(
+            f"{name} is deprecated and will be removed in safeuploads"
+            f" 3.0; use {new_name}",
+            DeprecationWarning,
+            # Skip this helper and the module ``__getattr__``
+            stacklevel=3,
+        )
+        return globals()[new_name]
+
+    def __getattr__(name: str) -> object:
+        """Resolve deprecated module attributes (PEP 562)."""
+        return _resolve_deprecated(__name__, name)
+
+
 class FileSecurityConfigurationError(Exception):
     """
     Configuration validation failed with aggregated errors.
 
     Args:
-        errors: List of ConfigValidationError instances.
+        errors: List of ConfigValidationIssue instances.
 
     Attributes:
         errors: List of validation errors that caused failure.
     """
 
-    def __init__(self, errors: list[ConfigValidationError]):
+    def __init__(self, errors: list[ConfigValidationIssue]):
         """Initialize with validation errors."""
         self.errors = errors
         error_messages = [
@@ -49,7 +96,7 @@ class FileSecurityConfigurationError(Exception):
             f"Configuration validation failed: {'; '.join(error_messages)}"
         )
 
-    def __reduce__(self) -> tuple[type, tuple[list[ConfigValidationError]]]:
+    def __reduce__(self) -> tuple[type, tuple[list[ConfigValidationIssue]]]:
         """Rebuild from ``errors`` so pickling round-trips."""
         return (type(self), (self.errors,))
 

{safeuploads-2.1.0 → safeuploads-2.2.0}/safeuploads/utils.py

@@ -11,20 +11,30 @@ from types import TracebackType
 from .exceptions import ErrorCode, ResourceLimitError
 from .protocols import SeekableFile
 
+logger = logging.getLogger(__name__)
+
+# ``resource.getrusage`` reports peak RSS (``ru_maxrss``) in bytes on
+# macOS but in kilobytes on Linux/BSD. Normalize to bytes with a
+# platform-specific multiplier resolved once at import time.
+_RSS_UNIT_BYTES: int = 1 if sys.platform == "darwin" else 1024
+
 try:
     # ``resource`` is a Unix-only stdlib module and is absent on
     # Windows; memory accounting degrades to a no-op there while
     # the wall-clock timeout keeps working.
     import resource
 except ImportError:  # pragma: no cover - platform-specific (Windows)
-    resource = None  # type: ignore[assignment]
 
-logger = logging.getLogger(__name__)
+    def _read_peak_rss_bytes() -> int:
+        """Return 0: this platform has no ``resource`` module."""
+        return 0
 
-# ``resource.getrusage`` reports peak RSS (``ru_maxrss``) in bytes on
-# macOS but in kilobytes on Linux/BSD. Normalize to bytes with a
-# platform-specific multiplier resolved once at import time.
-_RSS_UNIT_BYTES: int = 1 if sys.platform == "darwin" else 1024
+else:
+
+    def _read_peak_rss_bytes() -> int:
+        """Return the process peak RSS in bytes from ``getrusage``."""
+        usage = resource.getrusage(resource.RUSAGE_SELF)
+        return usage.ru_maxrss * _RSS_UNIT_BYTES
 
 
 def bytes_to_mb(num_bytes: int) -> int:
@@ -316,10 +326,7 @@ class ResourceMonitor:
             module (e.g. Windows), which disables memory-limit
             enforcement while leaving the timeout active.
         """
-        if resource is None:  # pragma: no cover - platform-specific
-            return 0
-        usage = resource.getrusage(resource.RUSAGE_SELF)
-        return usage.ru_maxrss * _RSS_UNIT_BYTES
+        return _read_peak_rss_bytes()
 
 
 _active_monitor: contextvars.ContextVar[ResourceMonitor | None] = (

{safeuploads-2.1.0 → safeuploads-2.2.0}/tests/inspectors/test_gzip_inspector.py

@@ -422,10 +422,11 @@ class TestGzipMemberHandling:
         )
         member = gzip.compress(bytes(400 * 1024))
         data = member * 4
-        with pytest.raises(ZipBombError):
+        with pytest.raises(ZipBombError) as exc_info:
             GzipContentInspector(config).inspect_gzip_content(
                 io.BytesIO(data), len(data)
             )
+        assert exc_info.value.error_code == ErrorCode.ZIP_BOMB_DETECTED
 
     def test_ratio_limit_counts_all_members(self):
         """The ratio is checked on the output summed across members."""

{safeuploads-2.1.0 → safeuploads-2.2.0}/tests/inspectors/test_zip_inspector.py

@@ -1042,8 +1042,9 @@ class TestZipInspectorStructureGaps:
 
         monkeypatch.setattr(zipfile.ZipFile, "open", _mock_open)
         caplog.set_level("WARNING", logger=zip_inspector.__name__)
-        with pytest.raises(ZipContentError):
+        with pytest.raises(ZipContentError) as exc_info:
             inspector.inspect_zip_content(io.BytesIO(zip_data))
+        assert exc_info.value.error_code == ErrorCode.ZIP_CONTENT_THREAT
 
         messages = [
             r.getMessage()
@@ -1318,8 +1319,9 @@ class TestZipInspectorNestedArchives:
 
         monkeypatch.setattr(zipfile.ZipFile, "open", _fail_open)
         caplog.set_level("WARNING", logger=zip_inspector.__name__)
-        with pytest.raises(ZipContentError):
+        with pytest.raises(ZipContentError) as exc_info:
             inspector.inspect_nested_archives(io.BytesIO(outer_bytes))
+        assert exc_info.value.error_code == ErrorCode.ZIP_CONTENT_THREAT
 
         messages = [
             r.getMessage()

{safeuploads-2.1.0 → safeuploads-2.2.0}/tests/test_audit.py

@@ -17,7 +17,6 @@ from safeuploads.audit import (
 )
 from safeuploads.config import FileSecurityConfig
 from safeuploads.exceptions import (
-    CompressionSecurityError,
     ErrorCode,
     FileSizeError,
     UnicodeSecurityError,
@@ -444,9 +443,12 @@ class TestThreatAuditEvents:
 
         with (
             caplog.at_level(logging.DEBUG, logger="safeuploads.audit"),
-            pytest.raises((ZipBombError, CompressionSecurityError)),
+            pytest.raises(ZipBombError) as exc_info,
         ):
             await validator.validate_zip_file(file)
+        assert (
+            exc_info.value.error_code == ErrorCode.COMPRESSION_RATIO_EXCEEDED
+        )
 
         threat_records = [
             r

{safeuploads-2.1.0 → safeuploads-2.2.0}/tests/test_config.py

@@ -6,7 +6,7 @@ import pytest
 
 from safeuploads.config import FileSecurityConfig, SecurityLimits
 from safeuploads.exceptions import (
-    ConfigValidationError,
+    ConfigValidationIssue,
     FileSecurityConfigurationError,
 )
 
@@ -171,8 +171,8 @@ class TestConfigurationValidation:
             pytest.fail("Should not raise for valid configuration")
 
     def test_config_validation_error_attributes(self):
-        """Test ConfigValidationError attributes."""
-        error = ConfigValidationError(
+        """Test ConfigValidationIssue attributes."""
+        error = ConfigValidationIssue(
             error_type="test_error",
             message="Test message",
             severity="error",
@@ -187,8 +187,8 @@ class TestConfigurationValidation:
         assert error.recommendation == "Test recommendation"
 
     def test_config_validation_error_string_representation(self):
-        """Test ConfigValidationError string representation."""
-        error = ConfigValidationError(
+        """Test ConfigValidationIssue string representation."""
+        error = ConfigValidationIssue(
             error_type="test_error",
             message="Test message",
             severity="error",
@@ -269,13 +269,13 @@ class TestConfigurationValidation:
 
     def test_file_security_configuration_error_with_errors(self):
         """Test FileSecurityConfigurationError with error list."""
-        error1 = ConfigValidationError(
+        error1 = ConfigValidationIssue(
             error_type="test1",
             message="Error 1",
             severity="error",
             component="test",
         )
-        error2 = ConfigValidationError(
+        error2 = ConfigValidationIssue(
             error_type="test2",
             message="Error 2",
             severity="warning",
@@ -368,7 +368,7 @@ class TestConfigInstanceIsolation:
             config.ALLOWED_ACTIVITY_EXTENSIONS.add(".evil")
 
 
-def _errors_for(**overrides: Any) -> list[ConfigValidationError]:
+def _errors_for(**overrides: Any) -> list[ConfigValidationIssue]:
     """
     Validate an instance whose limits carry the given overrides.
 

{safeuploads-2.1.0 → safeuploads-2.2.0}/tests/test_config_validation.py

@@ -15,6 +15,7 @@ from safeuploads.enums import (
     UnicodeAttackCategory,
 )
 from safeuploads.exceptions import (
+    ErrorCode,
     FileSecurityConfigurationError,
     WindowsReservedNameError,
 )
@@ -817,7 +818,7 @@ class TestValidateAndReportLogging:
         """
         import logging
 
-        from safeuploads.exceptions import ConfigValidationError
+        from safeuploads.exceptions import ConfigValidationIssue
 
         original = FileSecurityConfig._validate_enum_consistency
 
@@ -825,7 +826,7 @@ class TestValidateAndReportLogging:
         def _force_info(cls):
             results = original.__func__(cls)
             results.append(
-                ConfigValidationError(
+                ConfigValidationIssue(
                     error_type="test_info",
                     message="Test info message",
                     severity="info",
@@ -1086,8 +1087,9 @@ class TestInstanceOverrideValidation:
         assert config.validate_instance() == []
         validator = FileValidator(config=config)
 
-        with pytest.raises(WindowsReservedNameError):
+        with pytest.raises(WindowsReservedNameError) as exc_info:
             validator._sanitize_filename("con.png")
+        assert exc_info.value.error_code == ErrorCode.WINDOWS_RESERVED_NAME
         assert validator._sanitize_filename("photo.png") == "photo.png"
 
     def test_class_validation_still_reports_class_problems(self, monkeypatch):