sarj-python-lint 1.14.3__tar.gz → 1.15.0__tar.gz

{sarj_python_lint-1.14.3 → sarj_python_lint-1.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sarj-python-lint
-Version: 1.14.3
+Version: 1.15.0
 Summary: Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults
 Project-URL: Homepage, https://code-standards.sarj.ai/rules/python/
 Project-URL: Documentation, https://code-standards.sarj.ai/rules/python/

{sarj_python_lint-1.14.3 → sarj_python_lint-1.15.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sarj-python-lint"
-version = "1.14.3"
+version = "1.15.0"
 description = "Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults"
 readme = "README.md"
 authors = [{ name = "sarj-ai" }]

{sarj_python_lint-1.14.3 → sarj_python_lint-1.15.0}/src/sarj_python_lint/_analysis_session.py

@@ -4,6 +4,7 @@ from typing import TYPE_CHECKING, final
 
 from sarj_python_lint._python_target import PythonTargetFacts
 from sarj_python_lint.rules._first_party import FirstPartyFacts
+from sarj_python_lint.rules._local_source import LocalSourceFacts
 from sarj_python_lint.rules._nominal_project import NominalProjectFacts
 
 
@@ -16,5 +17,6 @@ class AnalysisSession:
     def __init__(self) -> None:
         self.project: ProjectIndexSet | None = None
         self.first_party = FirstPartyFacts()
+        self.local_source = LocalSourceFacts()
         self.python_target = PythonTargetFacts()
         self.nominal_project = NominalProjectFacts()

{sarj_python_lint-1.14.3 → sarj_python_lint-1.15.0}/src/sarj_python_lint/rules/_imports.py

@@ -85,7 +85,14 @@ def _non_import_bindings(tree: ast.Module) -> set[str]:
     names: set[str] = set()
     for node in walk_ast(tree):
         match node:
-            case ast.Name(id=name, ctx=(ast.Store() | ast.Del())) | ast.arg(arg=name):
+            case (
+                ast.Name(id=name, ctx=(ast.Store() | ast.Del()))
+                | ast.arg(arg=name)
+                | ast.ExceptHandler(name=str() as name)
+                | ast.MatchAs(name=str() as name)
+                | ast.MatchStar(name=str() as name)
+                | ast.MatchMapping(rest=str() as name)
+            ):
                 names.add(name)
             case ast.FunctionDef() | ast.AsyncFunctionDef() | ast.ClassDef():
                 names.add(node.name)
@@ -142,7 +149,13 @@ def _collect_module_bindings(node: ast.AST, names: set[str]) -> None:
             return
         case ast.Lambda():
             return
-        case ast.Name(id=name, ctx=(ast.Store() | ast.Del())):
+        case (
+            ast.Name(id=name, ctx=(ast.Store() | ast.Del()))
+            | ast.ExceptHandler(name=str() as name)
+            | ast.MatchAs(name=str() as name)
+            | ast.MatchStar(name=str() as name)
+            | ast.MatchMapping(rest=str() as name)
+        ):
             names.add(name)
         case _:
             pass

sarj_python_lint-1.15.0/src/sarj_python_lint/rules/_local_source.py

@@ -0,0 +1,123 @@
+from __future__ import annotations
+
+import ast
+from dataclasses import dataclass
+from pathlib import Path
+from typing import TYPE_CHECKING, final
+
+from sarj_python_lint.rules._imports import ImportIndex
+
+
+if TYPE_CHECKING:
+    from sarj_python_lint.rules._first_party import FirstPartyFacts
+
+
+_MAX_ANCESTORS = 24
+_MAX_MODULE_BYTES = 256_000
+_MAX_MODULES = 512
+
+
+@dataclass(frozen=True, slots=True)
+class LocalModule:
+    path: Path
+    source: str
+    tree: ast.Module
+    runtime_imports: ImportIndex
+
+
+@final
+class LocalSourceFacts:
+    def __init__(self) -> None:
+        self._resolutions: dict[tuple[Path, str | None, int], Path | None] = {}
+        self._modules: dict[Path, LocalModule | None] = {}
+
+    def resolve_module(self, current: Path, module: str | None, level: int, *, facts: FirstPartyFacts) -> Path | None:
+        try:
+            current = current.absolute()
+        except OSError:
+            return None
+        key = (current, module, level)
+        if key in self._resolutions:
+            return self._resolutions[key]
+        if len(self._resolutions) >= _MAX_MODULES:
+            return None
+        result = _resolve_module(current, module, level, facts=facts)
+        self._resolutions[key] = result
+        return result
+
+    def read_module(self, path: Path) -> LocalModule | None:
+        if path in self._modules:
+            return self._modules[path]
+        if len(self._modules) >= _MAX_MODULES:
+            return None
+        module = _read_module(path)
+        self._modules[path] = module
+        return module
+
+
+def _resolve_module(current: Path, module: str | None, level: int, *, facts: FirstPartyFacts) -> Path | None:
+    if ".." in current.parts or level > _MAX_ANCESTORS:
+        return None
+    root = facts.project_root(current)
+    if root is None or not _safe_path(current, root):
+        return None
+    parts = module.split(".") if module else []
+    if any(not part.isidentifier() for part in parts):
+        return None
+    candidates: set[Path] = set()
+    for base in _import_bases(current, root, level):
+        target = base.joinpath(*parts)
+        for candidate in (target.with_suffix(".py"), target / "__init__.py"):
+            if _safe_path(candidate, root) and candidate.is_file():
+                candidates.add(candidate)
+    return next(iter(candidates)) if len(candidates) == 1 else None
+
+
+def _import_bases(current: Path, root: Path, level: int) -> list[Path]:
+    if level:
+        base = current.parent
+        for _ in range(level - 1):
+            if base == root:
+                return []
+            base = base.parent
+        return [base]
+    bases: list[Path] = []
+    for ancestor in list(current.parents)[:_MAX_ANCESTORS]:
+        if not ancestor.is_relative_to(root):
+            break
+        bases.append(ancestor)
+        if (ancestor / "pyproject.toml").is_file():
+            bases.append(ancestor / "src")
+        if ancestor == root:
+            break
+    return bases
+
+
+def _safe_path(path: Path, root: Path) -> bool:
+    if not path.is_relative_to(root):
+        return False
+    try:
+        for entry in (path, *list(path.parents)[:_MAX_ANCESTORS]):
+            if entry == root:
+                return True
+            if entry.is_symlink() or (entry != path and (entry / ".git").exists()):
+                return False
+    except OSError:
+        return False
+    return False
+
+
+def _read_module(path: Path) -> LocalModule | None:
+    try:
+        with path.open("rb") as stream:
+            data = stream.read(_MAX_MODULE_BYTES + 1)
+        if len(data) > _MAX_MODULE_BYTES:
+            return None
+        source = data.decode("utf-8")
+        tree = ast.parse(source, filename=str(path))
+    except OSError, UnicodeError, SyntaxError:
+        return None
+    runtime_imports = ast.Module(
+        body=[node for node in tree.body if isinstance(node, (ast.Import, ast.ImportFrom))], type_ignores=[]
+    )
+    return LocalModule(path, source, tree, ImportIndex.from_tree(runtime_imports))

{sarj_python_lint-1.14.3 → sarj_python_lint-1.15.0}/src/sarj_python_lint/rules/_registry.py

@@ -133,6 +133,7 @@ from sarj_python_lint.rules.prefer_non_nullable_collection import (
 )
 from sarj_python_lint.rules.prefer_or_pattern import PreferOrPattern
 from sarj_python_lint.rules.prefer_pydantic_json_value import PreferPydanticJsonValue
+from sarj_python_lint.rules.prefer_pytest_fixture_injection import PreferPytestFixtureInjection
 from sarj_python_lint.rules.prefer_regex_fullmatch import PreferRegexFullmatch
 from sarj_python_lint.rules.prefer_self_documenting_constant import (
     PreferSelfDocumentingConstant,
@@ -278,6 +279,7 @@ REGISTRY: Mapping[str, type[Rule]] = MappingProxyType(
         NoRepeatedTestBody.id: NoRepeatedTestBody,
         UnusedMockSetup.id: UnusedMockSetup,
         UnusedTestFactoryOption.id: UnusedTestFactoryOption,
+        PreferPytestFixtureInjection.id: PreferPytestFixtureInjection,
         PreferFstringOverConcat.id: PreferFstringOverConcat,
         PreferOrPattern.id: PreferOrPattern,
         PreferPydanticJsonValue.id: PreferPydanticJsonValue,

{sarj_python_lint-1.14.3 → sarj_python_lint-1.15.0}/src/sarj_python_lint/rules/async_mock_call_without_await_assertion.py

@@ -476,8 +476,19 @@ def _invalidates_reference(node: ast.AST, reference: _Reference, binding: ast.Na
     match node:
         case ast.Name(id=name, ctx=ast.Store() | ast.Del()):
             return node is not binding and name == reference[0]
-        case ast.arg(arg=name):
+        case (
+            ast.arg(arg=name)
+            | ast.FunctionDef(name=name)
+            | ast.AsyncFunctionDef(name=name)
+            | ast.ClassDef(name=name)
+            | ast.ExceptHandler(name=str() as name)
+            | ast.MatchAs(name=str() as name)
+            | ast.MatchStar(name=str() as name)
+            | ast.MatchMapping(rest=str() as name)
+        ):
             return name == reference[0]
+        case ast.alias(name=imported, asname=alias):
+            return (alias or imported.partition(".")[0]) == reference[0]
         case ast.Global(names=names) | ast.Nonlocal(names=names):
             return reference[0] in names
         case ast.Attribute(ctx=ast.Store() | ast.Del()):

{sarj_python_lint-1.14.3 → sarj_python_lint-1.15.0}/src/sarj_python_lint/rules/iac_source_coupled_test.py

@@ -51,6 +51,8 @@ class IacSourceCoupledTest(Rule):
             "Files produced beneath recognized temporary-directory fixtures are generated outputs and remain unreported.",
             "The Python detector currently owns Terraform and HCL suffixes; YAML remains with the general source-coupled rule.",
             "Fixture, golden, and snapshot paths are treated as deliberate representation contracts; other packaging, formatter, and compatibility contracts require an exact suppression.",
+            "Lambda bodies and unconsumed generators are not inferred. Comprehension targets and match captures cannot inherit stale outer source provenance; proven builtin all/any line-content checks remain in scope.",
+            "Exact byte copies into proven temporary outputs and same-path byte preservation following a visible write_bytes of the compared named value remain unreported. Fixed-source byte equality and unproven or overwritten writes still require an exact representation-contract suppression.",
         ),
         examples=(
             RuleExample(

{sarj_python_lint-1.14.3 → sarj_python_lint-1.15.0}/src/sarj_python_lint/rules/no_hidden_constructor_fallback.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import ast
+from collections import Counter
 from dataclasses import dataclass, field
 import os
 from pathlib import Path, PurePosixPath
@@ -29,6 +30,14 @@ if TYPE_CHECKING:
 
 _MIGRATION_PARTS = frozenset({"alembic", "migration", "migrations", "versions"})
 _DESCRIPTOR_DECORATORS = frozenset({"classmethod", "staticmethod"})
+_CLASS_PRESERVING_DECORATORS = frozenset(
+    {
+        ("typing", "final"),
+        ("typing", "runtime_checkable"),
+        ("typing_extensions", "final"),
+        ("typing_extensions", "runtime_checkable"),
+    }
+)
 _QUALIFIED_NAME_PARTS = 2
 _SCAN_SKIP_PARTS = frozenset(
     {
@@ -76,6 +85,7 @@ class _CanonicalSymbol(NamedTuple):
 @dataclass(slots=True)
 class RuntimeConfigFacts:
     modules: dict[Path, ast.Module] = field(default_factory=dict)
+    stable_symbols: dict[Path, frozenset[str]] = field(default_factory=dict)
     composition_calls: dict[tuple[Path, str, str], bool] = field(default_factory=dict)
     canonical_symbols: dict[tuple[Path, str, str], _CanonicalSymbol] = field(default_factory=dict)
 
@@ -92,6 +102,7 @@ class NoHiddenConstructorFallback(Rule):
         category=RuleCategory.ARCHITECTURE,
         limitations=(
             "Detection requires a proven local settings provider and a first-party composition call; covers None fallbacks and settings attributes captured directly in module-level class constructor defaults.",
+            "Provider instance, class, import and reexport names require one stable module binding. Reassignments, captures, global writers, wildcard imports and unknown class decorators conservatively exclude settings provenance; annotation-only declarations, read-only globals and stable typing final/runtime_checkable decorators remain valid.",
             "Tests, generated files, migrations, descriptors, library environment fallbacks, and unconstructed classes are excluded.",
         ),
         examples=(
@@ -412,6 +423,8 @@ class RuntimeConfigResolver:
             return False
         if parts[0] in shadowed:
             return False
+        if parts[0] not in self._stable_symbols(_LoadedModule(self._tree, self._path)):
+            return False
         resolved = _resolve_expression(expression, self._imports)
         if resolved is None:
             if self._module is None:
@@ -437,8 +450,12 @@ class RuntimeConfigResolver:
             return False
         tree = loaded.tree
         module_path = loaded.path
+        stable = self._stable_symbols(loaded)
+        if symbol not in stable:
+            self._settings_cache[key] = False
+            return False
         imports = _imports(tree, module, is_package=module_path.name == "__init__.py")
-        classes = _base_settings_classes(tree, imports)
+        classes = _base_settings_classes(tree, imports, stable)
         factory = _assigned_factory(tree, symbol)
         if factory is not None:
             resolved_factory = _resolve_expression(factory, imports)
@@ -477,27 +494,47 @@ class RuntimeConfigResolver:
             return False
         tree = loaded.tree
         module_path = loaded.path
+        stable = self._stable_symbols(loaded)
+        if symbol not in stable:
+            self._settings_class_cache[key] = False
+            return False
         imports = _imports(tree, module, is_package=module_path.name == "__init__.py")
-        if symbol in _base_settings_classes(tree, imports):
+        if symbol in _base_settings_classes(tree, imports, stable):
             self._settings_class_cache[key] = True
             return True
         class_node = next(
             (node for node in tree.body if isinstance(node, ast.ClassDef) and node.name == symbol),
             None,
         )
-        result = False
-        if class_node is not None:
-            for base in class_node.bases:
-                resolved = _resolve_expression(base, imports)
-                if resolved is None or len(resolved) < _QUALIFIED_NAME_PARTS:
-                    continue
-                base_module, base_symbol = ".".join(resolved[:-1]), resolved[-1]
-                if self._is_settings_class(base_module, base_symbol, seen | {key}):
-                    result = True
-                    break
+        result = class_node is not None and self._inherits_settings_class(class_node, imports, stable, seen | {key})
         self._settings_class_cache[key] = result
         return result
 
+    def _inherits_settings_class(
+        self,
+        node: ast.ClassDef,
+        imports: dict[str, _Binding],
+        stable: frozenset[str],
+        seen: frozenset[tuple[str, str]],
+    ) -> bool:
+        if not _class_decorators_preserve_type(node, imports, stable):
+            return False
+        for base in node.bases:
+            resolved = _stable_import_reference(base, imports, stable)
+            if resolved is None or len(resolved) < _QUALIFIED_NAME_PARTS:
+                continue
+            base_module, base_symbol = ".".join(resolved[:-1]), resolved[-1]
+            if self._is_settings_class(base_module, base_symbol, seen):
+                return True
+        return False
+
+    def _stable_symbols(self, loaded: _LoadedModule) -> frozenset[str]:
+        cached = self._facts.stable_symbols.get(loaded.path)
+        if cached is None:
+            cached = _stable_module_symbols(loaded.tree)
+            self._facts.stable_symbols[loaded.path] = cached
+        return cached
+
     def _load_module(self, module: str) -> _LoadedModule | None:
         if module == self._module:
             return _LoadedModule(self._tree, self._path)
@@ -558,12 +595,21 @@ def _attribute_parts(expression: ast.expr) -> tuple[str, ...] | None:
     return None
 
 
-def _base_settings_classes(tree: ast.Module, imports: dict[str, _Binding]) -> set[str]:
-    classes = [statement for statement in tree.body if isinstance(statement, ast.ClassDef)]
+def _base_settings_classes(tree: ast.Module, imports: dict[str, _Binding], stable: frozenset[str]) -> set[str]:
+    classes = [
+        statement
+        for statement in tree.body
+        if isinstance(statement, ast.ClassDef)
+        and statement.name in stable
+        and _class_decorators_preserve_type(statement, imports, stable)
+    ]
     found = {
         node.name
         for node in classes
-        if any(_resolve_expression(base, imports) == ("pydantic_settings", "BaseSettings") for base in node.bases)
+        if any(
+            _stable_import_reference(base, imports, stable) == ("pydantic_settings", "BaseSettings")
+            for base in node.bases
+        )
     }
     changed = True
     while changed:
@@ -575,6 +621,44 @@ def _base_settings_classes(tree: ast.Module, imports: dict[str, _Binding]) -> se
     return found
 
 
+def _class_decorators_preserve_type(node: ast.ClassDef, imports: dict[str, _Binding], stable: frozenset[str]) -> bool:
+    return all(
+        _stable_import_reference(decorator, imports, stable) in _CLASS_PRESERVING_DECORATORS
+        for decorator in node.decorator_list
+    )
+
+
+def _stable_import_reference(
+    expression: ast.expr, imports: dict[str, _Binding], stable: frozenset[str]
+) -> tuple[str, ...] | None:
+    parts = _attribute_parts(expression)
+    if parts is None or parts[0] not in stable:
+        return None
+    return _resolve_expression(expression, imports)
+
+
+def _stable_module_symbols(tree: ast.Module) -> frozenset[str]:
+    if any(
+        isinstance(node, ast.ImportFrom) and any(alias.name == "*" for alias in node.names) for node in ast.walk(tree)
+    ):
+        return frozenset()
+    bindings: Counter[str] = Counter()
+    for statement in tree.body:
+        if isinstance(statement, ast.AnnAssign) and statement.value is None:
+            continue
+        collector = LocalBindingCollector()
+        collector.visit(statement)
+        bindings.update(collector.names)
+    global_writes: set[str] = set()
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
+            collector = LocalBindingCollector()
+            for statement in node.body:
+                collector.visit(statement)
+            global_writes.update(collector.names & collector.globals)
+    return frozenset(name for name, count in bindings.items() if count == 1 and name not in global_writes)
+
+
 def _assigned_factory(tree: ast.Module, symbol: str) -> ast.expr | None:
     for statement in tree.body:
         if isinstance(statement, ast.Assign):
@@ -842,9 +926,32 @@ class LocalBindingCollector(ast.NodeVisitor):
 
     @override
     def visit_Name(self, node: ast.Name) -> None:
-        if isinstance(node.ctx, ast.Store):
+        if isinstance(node.ctx, (ast.Store, ast.Del)):
             self.names.add(node.id)
 
+    @override
+    def visit_ExceptHandler(self, node: ast.ExceptHandler) -> None:
+        if node.name is not None:
+            self.names.add(node.name)
+        self.generic_visit(node)
+
+    @override
+    def visit_MatchAs(self, node: ast.MatchAs) -> None:
+        if node.name is not None:
+            self.names.add(node.name)
+        self.generic_visit(node)
+
+    @override
+    def visit_MatchStar(self, node: ast.MatchStar) -> None:
+        if node.name is not None:
+            self.names.add(node.name)
+
+    @override
+    def visit_MatchMapping(self, node: ast.MatchMapping) -> None:
+        if node.rest is not None:
+            self.names.add(node.rest)
+        self.generic_visit(node)
+
     @override
     def visit_Import(self, node: ast.Import) -> None:
         self.names.update(alias.asname or alias.name.partition(".")[0] for alias in node.names)
@@ -860,34 +967,60 @@ class LocalBindingCollector(ast.NodeVisitor):
     @override
     def visit_FunctionDef(self, node: ast.FunctionDef) -> None:
         self.names.add(node.name)
+        for outer in (
+            *node.decorator_list,
+            *node.args.defaults,
+            *(default for default in node.args.kw_defaults if default is not None),
+        ):
+            self.visit(outer)
 
     @override
     def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef) -> None:
         self.names.add(node.name)
+        for outer in (
+            *node.decorator_list,
+            *node.args.defaults,
+            *(default for default in node.args.kw_defaults if default is not None),
+        ):
+            self.visit(outer)
 
     @override
     def visit_ClassDef(self, node: ast.ClassDef) -> None:
         self.names.add(node.name)
+        for outer in (*node.decorator_list, *node.bases, *node.keywords):
+            self.visit(outer)
 
     @override
     def visit_Lambda(self, node: ast.Lambda) -> None:
-        return None
+        for default in (*node.args.defaults, *(value for value in node.args.kw_defaults if value is not None)):
+            self.visit(default)
 
     @override
     def visit_ListComp(self, node: ast.ListComp) -> None:
-        return None
+        self.visit(node.elt)
+        self._visit_generators(node.generators)
 
     @override
     def visit_SetComp(self, node: ast.SetComp) -> None:
-        return None
+        self.visit(node.elt)
+        self._visit_generators(node.generators)
 
     @override
     def visit_DictComp(self, node: ast.DictComp) -> None:
-        return None
+        self.visit(node.key)
+        self.visit(node.value)
+        self._visit_generators(node.generators)
 
     @override
     def visit_GeneratorExp(self, node: ast.GeneratorExp) -> None:
-        return None
+        self.visit(node.elt)
+        self._visit_generators(node.generators)
+
+    def _visit_generators(self, generators: list[ast.comprehension]) -> None:
+        for generator in generators:
+            self.visit(generator.iter)
+            for condition in generator.ifs:
+                self.visit(condition)
 
 
 def _bind_import_modules(statement: ast.Import, bindings: dict[str, _Binding]) -> None:

{sarj_python_lint-1.14.3 → sarj_python_lint-1.15.0}/src/sarj_python_lint/rules/no_injected_module_loader.py

@@ -53,7 +53,7 @@ class NoInjectedModuleLoader(Rule):
         limitations=(
             "Flags defaults resolving to importlib.import_module, importlib.__import__, or builtins.__import__, including stable module-level import and single-assignment aliases and unshadowed __import__.",
             "Tests, test support, and generated code are excluded. Required loader parameters, application loaders, wrapper lambdas, alias chains, comprehensions, and imports local to enclosing scopes are not inferred.",
-            "Conservatively skips shadowed or rebound names, wildcard-import files, reassigned loader attributes, and exception or pattern captures of importer roots, symbols or assignment aliases. A relevant-name capture in an unrelated local scope can cause a false negative because capture checks are file-wide.",
+            "Conservatively skips shadowed or rebound names, wildcard-import files, reassigned loader attributes, conflicting conditional or relative imports, and exception or pattern captures of importer roots, symbols or assignment aliases. Identical repeated importer imports remain valid. A relevant-name capture in an unrelated local scope can cause a false negative because capture checks are file-wide.",
             "Assignment aliases require one module binding and precede use by line and column. Defaults use their enclosing evaluation scope: earlier statements in the nearest executing class body can shadow loaders; methods and nested classes do not close over class attributes. Enclosing function body bindings remain conservative exclusions, but a function's parameters do not shadow its own defaults. Relevant global declarations and walrus writes exclude sensitive importer names. Compound class statements can cause conservative omissions. Dynamic namespace mutation is not inferred. No autofix: changing arguments or import placement can alter API and initialization behavior.",
         ),
         examples=(
@@ -134,6 +134,8 @@ def _ambiguous_loader_bindings(context: PythonFileContext, aliases: Mapping[str,
         if (target.module in {"importlib", "builtins"} and target.symbol is None)
         or f"{target.module}.{target.symbol}" in _LOADER_TARGETS
     }
+    if _conflicting_loader_imports(context, sensitive_names):
+        return True
     if any(sensitive_names.intersection(node.names) for node in context.nodes(ast.Global)):
         return True
     for node in context.nodes(ast.ExceptHandler, ast.MatchAs, ast.MatchStar, ast.MatchMapping, ast.NamedExpr):
@@ -154,6 +156,35 @@ def _ambiguous_loader_bindings(context: PythonFileContext, aliases: Mapping[str,
     )
 
 
+def _conflicting_loader_imports(context: PythonFileContext, sensitive_names: set[str]) -> bool:
+    for statement in context.nodes(ast.Import, ast.ImportFrom):
+        if not _is_module_binding(statement, context):
+            continue
+        for alias in statement.names:
+            name = alias.asname or alias.name.partition(".")[0]
+            if name in sensitive_names and _loader_import_conflicts(statement, alias, name, context):
+                return True
+    return False
+
+
+def _loader_import_conflicts(
+    statement: ast.Import | ast.ImportFrom,
+    alias: ast.alias,
+    name: str,
+    context: PythonFileContext,
+) -> bool:
+    if isinstance(statement, ast.ImportFrom):
+        if statement.level or statement.module is None:
+            return True
+        imported = (statement.module, alias.name)
+    else:
+        imported = (alias.name if alias.asname else alias.name.partition(".")[0], None)
+    binding = context.module_imports.bindings.get(name)
+    if binding is not None:
+        return imported != (binding.module, binding.symbol)
+    return name == "__import__" and ".".join(part for part in imported if part is not None) not in _LOADER_TARGETS
+
+
 def _defaults(arguments: ast.arguments) -> Iterator[tuple[ast.arg, ast.expr]]:
     positional = (*arguments.posonlyargs, *arguments.args)
     defaulted = positional[-len(arguments.defaults) :] if arguments.defaults else ()

{sarj_python_lint-1.14.3 → sarj_python_lint-1.15.0}/src/sarj_python_lint/rules/no_nullable_dependency_fallback.py

@@ -67,7 +67,7 @@ class NoNullableDependencyFallback(Rule):
         limitations=(
             "Warns for None-defaulted function parameters with a fallback used as a callable or a proven application-settings fallback; genuine absent state is allowed.",
             "Constructors remain owned by SARJ095 and SARJ468. Decorated functions, tests, generated code, nested scope captures, non-callable object fallbacks, and interprocedural forwarding are excluded.",
-            "Callable use through a local assignment, annotation or None guard requires at most one body binding for that name and a call after the binding statement completes. Rebinding, deletion, imports, definitions, pattern or exception captures, global/nonlocal declarations and nested-scope bindings conservatively exclude that inference; direct inline calls and proven settings fallbacks remain independent.",
+            "Callable use through a local assignment, annotation or None guard requires at most one body binding for that name and a call after the binding statement completes. Rebinding, deletion, imports, definitions, pattern or exception captures, global/nonlocal declarations and nested-scope bindings conservatively exclude that inference; direct inline calls remain independent. Settings provenance also excludes enclosing bindings and names written by a function declaring them global, while read-only global declarations remain valid.",
             "No autofix: removing explicit None acceptance changes the callable contract, and moving a fallback can change initialization timing or error handling.",
         ),
         examples=(
@@ -123,7 +123,7 @@ class NoNullableDependencyFallback(Rule):
             parameters = _none_default_parameters(function.args)
             if not parameters:
                 continue
-            hidden = _hidden_dependencies(function, parameters, resolver)
+            hidden = _hidden_dependencies(function, parameters, resolver, _settings_shadowed(function, context))
             findings.extend(
                 Diagnostic(
                     path=context.path,
@@ -156,11 +156,11 @@ def _hidden_dependencies(
     function: ast.FunctionDef | ast.AsyncFunctionDef,
     parameters: dict[str, ast.arg],
     resolver: RuntimeConfigResolver,
+    shadowed: set[str],
 ) -> set[str]:
     usage = _scope_usage(function)
     candidates = set(parameters)
     hidden: set[str] = set()
-    shadowed = set(scope_bindings(function))
     for statement in function.body:
         guard = _guarded_fallback(statement, candidates)
         bindings = LocalBindingCollector()
@@ -187,6 +187,19 @@ def _hidden_dependencies(
     return hidden
 
 
+def _settings_shadowed(
+    function: ast.FunctionDef | ast.AsyncFunctionDef,
+    context: PythonFileContext,
+) -> set[str]:
+    shadowed: set[str] = set()
+    current: ast.AST | None = function
+    while current is not None:
+        if isinstance(current, (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda)):
+            shadowed.update(scope_bindings(current))
+        current = context.parents.get(current)
+    return shadowed
+
+
 def _scope_usage(function: ast.FunctionDef | ast.AsyncFunctionDef) -> _ScopeUsage:
     nodes = [node for statement in function.body for node in _scope_nodes(statement)]
     parents = {child: node for node in nodes for child in ast.iter_child_nodes(node)}