sarj-python-lint 1.40.1__tar.gz → 1.41.1__tar.gz

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sarj-python-lint
-Version: 1.40.1
+Version: 1.41.1
 Summary: Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults
 Project-URL: Homepage, https://code-standards.sarj.ai/rules/python/
 Project-URL: Documentation, https://code-standards.sarj.ai/rules/python/

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sarj-python-lint"
-version = "1.40.1"
+version = "1.41.1"
 description = "Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults"
 readme = "README.md"
 authors = [{ name = "sarj-ai" }]

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/src/sarj_python_lint/rules/_resource_provenance.py

@@ -95,9 +95,22 @@ class ResourceProvenance:
 
     def scope(self, node: ast.AST) -> ast.AST | None:
         parent = self.context.parents.get(node)
-        while parent is not None and not isinstance(parent, _SCOPES):
+        while parent is not None:
+            if isinstance(parent, ast.arguments) and (node in parent.defaults or node in parent.kw_defaults):
+                parent = self.context.parents.get(parent)
+            elif isinstance(parent, _SCOPES) and not (
+                (
+                    isinstance(parent, ast.FunctionDef | ast.AsyncFunctionDef | ast.ClassDef)
+                    and node in parent.decorator_list
+                )
+                or (isinstance(parent, ast.ClassDef) and (node in parent.bases or node in parent.keywords))
+            ):
+                return parent
+            if parent is None:
+                return None
+            node = parent
             parent = self.context.parents.get(parent)
-        return parent
+        return None
 
     def _binding_scope(self, node: ast.AST) -> ast.AST | None:
         scope = self.scope(node)

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/src/sarj_python_lint/rules/no_cors_wildcard_with_credentials.py

@@ -14,7 +14,6 @@ from sarj_python_lint.rule_base import (
     RuleDocumentation,
     RuleExample,
 )
-from sarj_python_lint.rules._ast_index import walk
 
 
 if TYPE_CHECKING:
@@ -37,8 +36,8 @@ class NoCorsWildcardWithCredentials(Rule):
         category=RuleCategory.SECURITY,
         autofix=AutofixPolicy.NONE,
         limitations=(
-            'The rule requires literal `True` for `allow_credentials` and either a literal `"*"` below `allow_origins` or an exact universal `allow_origin_regex` literal.',
-            "Dynamically computed credential flags and origin collections are not resolved.",
+            'The rule requires literal `True` for `allow_credentials` and either a direct `"*"` origin in a literal collection or an exact universal `allow_origin_regex` literal. Literal keyword dictionaries and their effective nested unpacks are inspected.',
+            "Conditional origin collections are checked in each possible branch. Calls, comprehensions, nested non-string elements, dynamic keyword unpacks, computed credential flags, and variable origin collections are not resolved.",
         ),
         examples=(
             RuleExample(
@@ -86,7 +85,7 @@ class NoCorsWildcardWithCredentials(Rule):
         for node in context.nodes(ast.Call):
             if not _is_cors_construction(node, imports):
                 continue
-            keywords = {arg: kw.value for kw in node.keywords if (arg := kw.arg) is not None}
+            keywords = _effective_keywords(node)
             credentials = keywords.get("allow_credentials")
             origins = keywords.get("allow_origins")
             origin_regex = keywords.get("allow_origin_regex")
@@ -121,7 +120,52 @@ def _is_true_literal(node: ast.expr) -> bool:
 
 
 def _contains_star_literal(node: ast.expr) -> bool:
-    return any(isinstance(child, ast.Constant) and child.value == "*" for child in walk(node))
+    match node:
+        case ast.Constant(value="*"):
+            return True
+        case ast.List(elts=elements) | ast.Tuple(elts=elements) | ast.Set(elts=elements):
+            return any(
+                (isinstance(element, ast.Constant) and element.value == "*")
+                or (isinstance(element, ast.Starred) and _contains_star_literal(element.value))
+                for element in elements
+            )
+        case ast.IfExp(body=body, orelse=orelse):
+            return _contains_star_literal(body) or _contains_star_literal(orelse)
+        case ast.BoolOp(values=values):
+            return any(_contains_star_literal(value) for value in values)
+        case _:
+            return False
+
+
+def _effective_keywords(node: ast.Call) -> dict[str, ast.expr]:
+    values: dict[str, ast.expr] = {}
+    for keyword in node.keywords:
+        if keyword.arg is not None:
+            values[keyword.arg] = keyword.value
+        elif isinstance(keyword.value, ast.Dict):
+            literal_values = _literal_dictionary_values(keyword.value)
+            if literal_values is None:
+                values.clear()
+            else:
+                values.update(literal_values)
+        else:
+            values.clear()
+    return values
+
+
+def _literal_dictionary_values(node: ast.Dict) -> dict[str, ast.expr] | None:
+    values: dict[str, ast.expr] = {}
+    for key, value in zip(node.keys, node.values, strict=True):
+        if isinstance(key, ast.Constant) and isinstance(key.value, str):
+            values[key.value] = value
+        elif key is None and isinstance(value, ast.Dict):
+            nested_values = _literal_dictionary_values(value)
+            if nested_values is None:
+                return None
+            values.update(nested_values)
+        else:
+            return None
+    return values
 
 
 def _is_cors_construction(node: ast.Call, imports: ImportIndex) -> bool:

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/src/sarj_python_lint/rules/no_loguru_printf_format.py

@@ -49,7 +49,7 @@ class NoLoguruPrintfFormat(Rule):
         autofix=AutofixPolicy.NONE,
         limitations=(
             "Only unambiguous module-level Loguru imports and immediate bind/opt chains with a literal message and supplied positional formatting arguments are checked.",
-            "The message must contain a valid percent conversion and no brace fields. Escaped percent signs alone, malformed templates, dynamic messages and expanded arguments are excluded.",
+            "The decoded literal message must contain a valid percent conversion and no brace fields; Unicode and hex escapes preserve conversions. Escaped percent signs alone, malformed templates, dynamic messages and expanded arguments are excluded.",
             "Standard logging, unknown receivers, stored aliases, shadowed or escaped imports, custom wrapper chains, keyword-only fields and generated files are excluded.",
             "Visible namespace or logger mutations invalidate import proof. Interprocedural effects and runtime monkeypatches are not resolved.",
             "Argument types and printf arity are not inferred. The warning requests review; no automatic conversion changes formatting or structured logging contracts.",
@@ -89,7 +89,7 @@ class NoLoguruPrintfFormat(Rule):
 
     @override
     def check_context(self, context: PythonFileContext) -> list[Diagnostic]:
-        if "%" not in context.source or "loguru" not in context.source or context.generated or context.tree is None:
+        if "loguru" not in context.source or context.generated or context.tree is None:
             return []
         provenance: ResourceProvenance | None = None
         diagnostics: list[Diagnostic] = []

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/src/sarj_python_lint/rules/no_offset_pagination.py

@@ -30,6 +30,13 @@ _OFFSET_PAGINATION = re.compile(
     re.IGNORECASE,
 )
 _MYSQL_OFFSET_PAGINATION = re.compile(rf"\bLIMIT\s+{_DYNAMIC_VALUE}\s*,", re.IGNORECASE)
+_OFFSET_START = re.compile(r"\bOFFSET\b\s+", re.IGNORECASE)
+_NUMERIC_OFFSET_TOKEN = re.compile(
+    rf"{_DYNAMIC_VALUE}|\d+(?:\.\d+)?|(?:GREATEST|LEAST|COALESCE|ABS|CEIL|CEILING|FLOOR)\b|[-()+*/%,]",
+    re.IGNORECASE,
+)
+_DYNAMIC_TOKEN = re.compile(_DYNAMIC_VALUE)
+_OFFSET_END = re.compile(r"\s*(?:ROWS?\b|FETCH\b|FOR\b|LIMIT\b|[);]|$)", re.IGNORECASE)
 _QUERY_SHAPE = re.compile(r"\bSELECT\b[\s\S]*?\bFROM\b", re.IGNORECASE)
 _MIGRATION_PARTS = frozenset({"migration", "migrations"})
 _QUOTED_IDENTIFIER = re.compile(r"`[^`\n]*`|\[[^\]\n]*\]")
@@ -55,6 +62,7 @@ class NoOffsetPagination(Rule):
         limitations=(
             "Only SQL string literals in recognized store modules are analyzed.",
             "Only dynamic OFFSET values in credible SELECT queries are reported; fixed ordinal offsets are excluded.",
+            "Parenthesized arithmetic and common numeric wrappers such as GREATEST, LEAST, and COALESCE preserve the dynamic driver marker. Arbitrary SQL functions and procedural values remain opaque.",
             "Generated files, migrations, docstrings, comments, quoted identifiers, and BigQuery `WITH OFFSET AS` array indexing are excluded.",
             "ORM pagination APIs are outside this embedded-SQL rule.",
         ),
@@ -117,7 +125,7 @@ class NoOffsetPagination(Rule):
 
             sql = _mask_dialect_noise(strip_sql_noise(text))
             if _QUERY_SHAPE.search(sql) is None or (
-                _OFFSET_PAGINATION.search(sql) is None and _MYSQL_OFFSET_PAGINATION.search(sql) is None
+                not _has_dynamic_numeric_offset(sql) and _MYSQL_OFFSET_PAGINATION.search(sql) is None
             ):
                 continue
 
@@ -138,6 +146,27 @@ class NoOffsetPagination(Rule):
         return diags
 
 
+def _has_dynamic_numeric_offset(sql: str) -> bool:
+    if _OFFSET_PAGINATION.search(sql) is not None:
+        return True
+    for start in _OFFSET_START.finditer(sql):
+        cursor, depth, dynamic = start.end(), 0, False
+        while cursor < len(sql):
+            if sql[cursor].isspace():
+                cursor += 1
+                continue
+            token = _NUMERIC_OFFSET_TOKEN.match(sql, cursor)
+            if token is None or (token.group() == ")" and depth == 0):
+                break
+            value = token.group()
+            depth += int(value == "(") - int(value == ")")
+            dynamic |= _DYNAMIC_TOKEN.fullmatch(value) is not None
+            cursor = token.end()
+        if dynamic and depth == 0 and _OFFSET_END.match(sql, cursor) is not None:
+            return True
+    return False
+
+
 def _sql_value(node: ast.expr) -> str | None:
     if isinstance(node, ast.JoinedStr):
         pieces: list[str] = []

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/src/sarj_python_lint/rules/no_random_uuid_in_sql.py

@@ -22,7 +22,7 @@ if TYPE_CHECKING:
     from sarj_python_lint._file_context import PythonFileContext
 
 
-_RANDOM_UUID_RE = re.compile(r"\b(?:gen_random_uuid|uuid_generate_v4)\s*\(", re.IGNORECASE)
+_RANDOM_UUID_RE = re.compile(r"(?<![\w$])(?:gen_random_uuid|uuid_generate_v4)\s*\(", re.IGNORECASE)
 
 
 @dataclass(frozen=True, slots=True)
@@ -155,7 +155,7 @@ def _inside_uuidv7_builder(sql: str, position: int) -> bool:
 
 def _identifier_end(sql: str, index: int, position: int) -> _IdentifierEnd:
     end = index + 1
-    while end < position and (sql[end].isalnum() or sql[end] == "_"):
+    while end < position and (sql[end].isalnum() or sql[end] in {"_", "$"}):
         end += 1
     after = end
     while after < position and sql[after].isspace():

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/src/sarj_python_lint/rules/no_secret_in_log.py

@@ -18,6 +18,7 @@ from sarj_python_lint.rules._logging import LOG_METHODS, is_logger_expr
 
 
 if TYPE_CHECKING:
+    from collections.abc import Iterable
     from pathlib import Path
 
     from sarj_python_lint._file_context import PythonFileContext
@@ -53,19 +54,31 @@ def _is_secret_keyword(name: str) -> bool:
 
 
 def _unsafe_message_values(value: ast.expr) -> tuple[ast.expr, ...]:
+    if _is_raw_secret_reference(value):
+        return (value,)
     match value:
         case ast.JoinedStr(values=parts):
             return _unsafe_formatted_values(parts)
+        case ast.BinOp(op=ast.Add(), left=left, right=right):
+            return (*_unsafe_message_values(left), *_unsafe_message_values(right))
+        case ast.List(elts=elements) | ast.Tuple(elts=elements) | ast.Set(elts=elements):
+            return tuple(secret for element in elements for secret in _unsafe_message_values(element))
+        case ast.Dict():
+            return _literal_mapping_secret_values(value)
         case ast.BinOp(op=ast.Mod(), right=right):
             values = right.elts if isinstance(right, (ast.Tuple, ast.List)) else (right,)
-            return tuple(item for item in values if _is_raw_secret_reference(item))
+            return _raw_secret_values(values)
         case ast.Call(func=ast.Attribute(value=ast.Constant(value=str()), attr="format"), args=args, keywords=keywords):
             values = (*args, *(keyword.value for keyword in keywords))
-            return tuple(item for item in values if _is_raw_secret_reference(item))
+            return _raw_secret_values(values)
         case _:
             return ()
 
 
+def _raw_secret_values(values: Iterable[ast.expr]) -> tuple[ast.expr, ...]:
+    return tuple(value for value in values if _is_raw_secret_reference(value))
+
+
 class NoSecretInLog(Rule):
     id: str = "no-secret-in-log"
     code: str = "SARJ012"
@@ -75,7 +88,7 @@ class NoSecretInLog(Rule):
         remediation="Omit the credential or log only approved non-sensitive metadata through a centralized sanitizer.",
         category=RuleCategory.SECURITY,
         limitations=(
-            "Detection covers direct secret-named names, terminal attributes, constant secret-key subscripts, identity slices, f-string and literal format arguments, nested literal extra mappings, literal keyword unpacking, and immediate structured-logger bindings.",
+            "Detection covers direct secret-named message and argument values, terminal attributes, constant secret-key subscripts, identity slices, f-string and literal format arguments, string concatenation, nested literal containers, literal keyword unpacking, and immediate structured-logger bindings.",
             "Logger recognition and secret classification are lexical; general aliases, arbitrary calls, dynamic containers, and interprocedural dataflow are not inspected.",
         ),
         examples=(
@@ -118,7 +131,7 @@ class NoSecretInLog(Rule):
             if not isinstance(function, ast.Attribute) or not _is_logging_call(node):
                 continue
             message_index = 1 if function.attr == "log" else 0
-            for arg in node.args:
+            for arg in node.args[message_index:]:
                 diags.extend(
                     Diagnostic(
                         path=path,
@@ -129,11 +142,6 @@ class NoSecretInLog(Rule):
                     )
                     for unsafe in _unsafe_message_values(arg)
                 )
-            diags.extend(
-                _diagnostic(path, arg, self.code, "positional logging argument")
-                for arg in node.args[message_index + 1 :]
-                if _is_raw_secret_reference(arg)
-            )
             _collect_keyword_secrets(path, node, self.code, diags)
             diags.extend(
                 _diagnostic(path, value, self.code, "structured logger binding")
@@ -147,7 +155,7 @@ def _bound_logger_values(receiver: ast.expr) -> tuple[ast.expr, ...]:
         return ()
     if receiver.func.attr not in {"bind", "contextualize"}:
         return ()
-    return tuple(keyword.value for keyword in receiver.keywords if _is_raw_secret_reference(keyword.value))
+    return tuple(secret for keyword in receiver.keywords for secret in _unsafe_message_values(keyword.value))
 
 
 def _diagnostic(path: Path, value: ast.expr, code: str, context: str) -> Diagnostic:
@@ -189,22 +197,15 @@ def _collect_keyword_secrets(path: Path, node: ast.Call, code: str, diags: list[
                 _diagnostic(path, value, code, "literal `extra` field")
                 for value in _literal_mapping_secret_values(kw.value)
             )
-        elif _is_raw_secret_reference(kw.value):
-            diags.append(_diagnostic(path, kw.value, code, f"`{kw.arg}` logging field"))
+        else:
+            diags.extend(
+                _diagnostic(path, value, code, f"`{kw.arg}` logging field")
+                for value in _unsafe_message_values(kw.value)
+            )
 
 
 def _literal_mapping_secret_values(mapping: ast.Dict) -> tuple[ast.expr, ...]:
-    return tuple(
-        secret
-        for _, value in _literal_mapping_items(mapping)
-        for secret in (
-            _literal_mapping_secret_values(value)
-            if isinstance(value, ast.Dict)
-            else (value,)
-            if _is_raw_secret_reference(value)
-            else ()
-        )
-    )
+    return tuple(secret for _, value in _literal_mapping_items(mapping) for secret in _unsafe_message_values(value))
 
 
 def _literal_mapping_items(mapping: ast.Dict) -> tuple[tuple[str, ast.expr], ...]:

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/src/sarj_python_lint/rules/prefer_constant_time_secret_compare.py

@@ -63,6 +63,7 @@ _ENV_CALLS = frozenset({"getenv"})
 _ENV_MAPPINGS = frozenset({"environ"})
 _EQUALITY_DUNDERS = frozenset({"__eq__", "__ne__"})
 _PAIR_OPERAND_COUNT = 2
+_ENCODE_ARGUMENT_LIMIT = 2
 _SCOPE_NODES = (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef, ast.Lambda)
 
 
@@ -108,7 +109,7 @@ class PreferConstantTimeSecretCompare(Rule):
         category=RuleCategory.SECURITY,
         limitations=(
             "The diagnostic requires evidence of an externally supplied credential and configured or stored secret state.",
-            "Only direct equality and unambiguous same-scope aliases from headers, cookies, settings, or environment are traced.",
+            "Adjacent equality pairs, literal encode normalization, and unambiguous same-scope aliases from headers, cookies, settings, or environment are traced.",
             "Generated files, tests, test-support modules, equality methods, public sentinels, and type-like values are excluded.",
             "`compare_digest` requires compatible ASCII string or bytes-like operands and may still reveal type or length.",
         ),
@@ -162,9 +163,7 @@ class PreferConstantTimeSecretCompare(Rule):
         dunder_compares = _equality_dunder_compares(tree, source, node_index=context.node_index)
         diagnostics: list[Diagnostic] = []
         for comparison in context.nodes(ast.Compare):
-            if id(comparison) in dunder_compares or len(comparison.ops) != 1:
-                continue
-            if not isinstance(comparison.ops[0], (ast.Eq, ast.NotEq)):
+            if id(comparison) in dunder_compares:
                 continue
             operands = [comparison.left, *comparison.comparators]
             if _is_password_confirmation_pair(operands):
@@ -176,7 +175,8 @@ class PreferConstantTimeSecretCompare(Rule):
             position = (comparison.lineno, comparison.col_offset)
             dominant_roles = _dominating_walrus_roles(comparison, parents, roles, position)
             operand_roles = [_operand_role(operand, roles, position, dominant_roles) for operand in operands]
-            if not _has_authentication_pair(operand_roles):
+            unsafe_pair = _unsafe_authentication_pair(comparison, operands, operand_roles)
+            if unsafe_pair is None:
                 continue
             diagnostics.append(
                 Diagnostic(
@@ -185,12 +185,24 @@ class PreferConstantTimeSecretCompare(Rule):
                     col=comparison.col_offset + 1,
                     code=self.code,
                     severity=Severity.ERROR,
-                    message=_message(operand_roles),
+                    message=_message(unsafe_pair),
                 )
             )
         return sorted(diagnostics, key=lambda item: (item.line, item.col))
 
 
+def _unsafe_authentication_pair(
+    comparison: ast.Compare, operands: list[ast.expr], operand_roles: list[_Role]
+) -> list[_Role] | None:
+    for index, operation in enumerate(comparison.ops):
+        if not isinstance(operation, (ast.Eq, ast.NotEq)):
+            continue
+        pair = operand_roles[index : index + 2]
+        if _has_authentication_pair(pair) and not _is_password_confirmation_pair(operands[index : index + 2]):
+            return pair
+    return None
+
+
 def _message(roles: list[_Role]) -> str:
     if any(role.password for role in roles):
         return "password equality may leak information; use the password-hashing library's verification API"
@@ -274,6 +286,11 @@ def _operand_role(
                 for value in node.values
                 if isinstance(value, ast.FormattedValue)
             )
+        case ast.Call(func=ast.Attribute(value=value, attr="encode"), args=arguments, keywords=[]):
+            if len(arguments) <= _ENCODE_ARGUMENT_LIMIT and all(
+                isinstance(argument, ast.Constant) and isinstance(argument.value, str) for argument in arguments
+            ):
+                return _operand_role(value, roles, position, dominant_roles)
         case _:
             pass
     if _is_external_lookup(node):

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/src/sarj_python_lint/rules/prefer_nominal_id_types.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import ast
+from collections import Counter
 from dataclasses import dataclass
 from pathlib import PurePosixPath
 import re
@@ -710,7 +711,8 @@ def _unambiguous_exports(tree: ast.Module, imports: ImportIndex, facts: _TypeFac
             assignments.setdefault(assignment.target, []).append(assignment)
     # Imports are re-exports only when their binding is unambiguous; local
     # aliases must have exactly one top-level assignment and no other writes.
-    unique = {name for name, values in assignments.items() if len(values) == 1 and _binding_count(tree, name) == 1}
+    bindings: Counter[str] = _binding_counts(tree) if assignments else Counter()
+    unique = {name for name, values in assignments.items() if len(values) == 1 and bindings.get(name, 0) == 1}
     allowed = unique | set(imports.bindings)
     return _TypeFacts(
         {name: shape for name, shape in facts.raw_aliases.items() if name in allowed},
@@ -718,15 +720,23 @@ def _unambiguous_exports(tree: ast.Module, imports: ImportIndex, facts: _TypeFac
     )
 
 
-def _binding_count(tree: ast.Module, name: str) -> int:
-    return sum(
-        1
-        for node in walk_ast(tree)
-        if (isinstance(node, ast.Name) and isinstance(node.ctx, (ast.Store, ast.Del)) and node.id == name)
-        or (isinstance(node, ast.arg) and node.arg == name)
-        or (isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)) and node.name == name)
-        or (isinstance(node, ast.alias) and (node.asname or node.name.partition(".")[0]) == name)
-    )
+def _binding_counts(tree: ast.Module) -> Counter[str]:
+    bindings: Counter[str] = Counter()
+    for node in walk_ast(tree):
+        match node:
+            case (
+                ast.Name(id=name, ctx=ast.Store() | ast.Del())
+                | ast.arg(arg=name)
+                | ast.FunctionDef(name=name)
+                | ast.AsyncFunctionDef(name=name)
+                | ast.ClassDef(name=name)
+            ):
+                bindings[name] += 1
+            case ast.alias(name=name, asname=alias):
+                bindings[alias or name.partition(".")[0]] += 1
+            case _:
+                continue
+    return bindings
 
 
 def _imported_facts(

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/src/sarj_python_lint/rules/prefer_walrus_regex_match.py

@@ -128,6 +128,9 @@ class PreferWalrusRegexMatch(Rule):
         tree = context.tree
         if tree is None:
             return []
+        candidate_bodies = _candidate_bodies(tree)
+        if not candidate_bodies:
+            return []
 
         source_lines = context.source_lines
         diags: list[Diagnostic] = []
@@ -153,11 +156,7 @@ class PreferWalrusRegexMatch(Rule):
             self.code,
         )
 
-        for node in walk(tree):
-            raw_body: object = getattr(node, "body", None)
-            if not object_list(raw_body):
-                continue
-            body: list[ast.stmt] = [st for st in raw_body if isinstance(st, ast.stmt)]
+        for node, body in candidate_bodies:
             diags.extend(_check_body(node, body, analysis_context))
 
         if diags and context.session.python_target.has_declared_support_before(path, (3, 8)):
@@ -165,6 +164,37 @@ class PreferWalrusRegexMatch(Rule):
         return sorted(diags, key=lambda d: (d.line, d.col))
 
 
+def _candidate_bodies(tree: ast.Module) -> list[tuple[ast.AST, list[ast.stmt]]]:
+    candidates: list[tuple[ast.AST, list[ast.stmt]]] = []
+    for node in walk(tree):
+        raw_body: object = getattr(node, "body", None)
+        if not object_list(raw_body):
+            continue
+        body = [statement for statement in raw_body if isinstance(statement, ast.stmt)]
+        if any(_is_candidate_pair(body[index], body[index + 1]) for index in range(len(body) - 1)):
+            candidates.append((node, body))
+    return candidates
+
+
+def _is_candidate_pair(assignment: ast.stmt, condition: ast.stmt) -> bool:
+    match assignment, condition:
+        case (
+            ast.Assign(
+                targets=[ast.Name(id=name)],
+                value=ast.Call(func=ast.Attribute(value=ast.Name(), attr=method)),
+            ),
+            ast.If(test=test),
+        ):
+            return (
+                method in _MATCH_METHODS
+                and assignment.end_lineno == assignment.lineno
+                and condition.lineno == assignment.lineno + 1
+                and _condition_kind(test, name) is not None
+            )
+        case _:
+            return False
+
+
 def _check_body(node: ast.AST, body: list[ast.stmt], context: _AnalysisContext) -> list[Diagnostic]:
     owner = _lexical_owner(node, context.parents)
     state = _body_state(node, owner, body, context)

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/src/sarj_python_lint/rules/require_pydantic_for_external_json.py

@@ -213,6 +213,12 @@ class RequirePydanticForExternalJson(Rule):
         if tree is None:
             return []
         imports = context.imports
+        if not any(
+            _is_json_loads(call, imports)
+            or (isinstance(call.func, ast.Attribute) and call.func.attr == "json" and not call.args)
+            for call in context.nodes(ast.Call)
+        ):
+            return []
         source_lines = context.source_lines
         summaries = _module_summaries(tree, imports, source_lines, node_index=context.node_index)
         findings: list[tuple[ast.expr, ast.Call]] = []

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/src/sarj_python_lint/rules/require_pydantic_ordinal_lower_bound.py

@@ -188,11 +188,21 @@ class RequirePydanticOrdinalLowerBound(Rule):
         tree = context.tree
         if tree is None:
             return []
+        candidates = tuple(
+            node
+            for node in tree.body
+            if isinstance(node, ast.ClassDef) and any(_is_ordinal_field(field) for field in node.body)
+        )
+        if not candidates:
+            return []
         imports = context.module_imports
+        models = tuple(cls for cls in candidates if _is_model(cls, imports))
+        if not models:
+            return []
         aliases = _annotation_aliases(tree)
         source_lines = context.source_lines
         diagnostics: list[Diagnostic] = []
-        for cls in (node for node in tree.body if isinstance(node, ast.ClassDef) and _is_model(node, imports)):
+        for cls in models:
             diagnostics.extend(
                 _ordinal_class_findings(
                     cls,
@@ -211,6 +221,15 @@ def _is_model(cls: ast.ClassDef, imports: ImportIndex) -> bool:
     return any(imports.resolves(base, sources=_PYDANTIC_MODEL_SOURCES, symbol="BaseModel") for base in cls.bases)
 
 
+def _is_ordinal_field(field: ast.stmt) -> bool:
+    return (
+        isinstance(field, ast.AnnAssign)
+        and isinstance(field.target, ast.Name)
+        and not field.target.id.startswith("_")
+        and _is_ordinal_field_name(field.target.id)
+    )
+
+
 def _annotation_aliases(tree: ast.Module) -> dict[str, ast.expr]:
     binding_counts = _module_binding_counts(tree)
     candidates: dict[str, list[ast.expr]] = {}

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/src/sarj_python_lint/rules/store_get_delegates_to_bulk_read.py

@@ -113,6 +113,7 @@ class StoreGetDelegatesToBulkRead(Rule):
             "Wrappers with try/finally or other unsupported compound control flow are not diagnosed.",
             "Singleton implementations with explicit cache or lock identifiers are excluded because their access path differs intentionally.",
             "Signature compatibility is advisory: dynamic helpers and behavior not visible in the two method bodies require review.",
+            "Closed literal starred collection expansions preserve singleton delegation; unknown iterable expansion or additional keys do not prove the singleton contract.",
         ),
         aliases=("get-delegates-to-get-many",),
         examples=(
@@ -689,8 +690,10 @@ def _symbol(expression: ast.expr, bindings: dict[str, str]) -> str:
         return bindings.get(expression.id, f"unknown:{expression.id}")
     if isinstance(expression, ast.Attribute):
         return f"attr:{_qualified_name(expression)}"
-    if isinstance(expression, (ast.List, ast.Tuple, ast.Set)) and len(expression.elts) == 1:
-        return f"one:{_symbol(expression.elts[0], bindings)}"
+    if isinstance(expression, (ast.List, ast.Tuple, ast.Set)):
+        elements = _closed_collection_elements(expression)
+        if elements is not None and len(elements) == 1:
+            return f"one:{_symbol(elements[0], bindings)}"
     if (
         isinstance(expression, ast.Call)
         and isinstance(expression.func, ast.Name)
@@ -702,6 +705,21 @@ def _symbol(expression: ast.expr, bindings: dict[str, str]) -> str:
     return f"unknown:{ast.dump(expression, include_attributes=False)}"
 
 
+def _closed_collection_elements(expression: ast.List | ast.Tuple | ast.Set) -> list[ast.expr] | None:
+    elements: list[ast.expr] = []
+    for item in expression.elts:
+        if not isinstance(item, ast.Starred):
+            elements.append(item)
+        elif isinstance(item.value, (ast.List, ast.Tuple, ast.Set)):
+            nested = _closed_collection_elements(item.value)
+            if nested is None:
+                return None
+            elements.extend(nested)
+        else:
+            return None
+    return elements
+
+
 def _compatible_pair(
     owner: ast.ClassDef,
 ) -> _MethodPair | None:

{sarj_python_lint-1.40.1 → sarj_python_lint-1.41.1}/src/sarj_python_lint/rules/store_insert_requires_on_conflict.py

@@ -29,7 +29,9 @@ if TYPE_CHECKING:
 
 # Strict keyword adjacency distinguishes SQL writes from prose.
 _INSERT_WRITE = re.compile(
-    r"\bINSERT\s+(?:OR\s+\w+\s+)?INTO\s+[\w.\"'`?$:@-]+\s*(?:\([^)]*\)\s*)?(?:VALUES|SELECT|DEFAULT\s+VALUES)\b",
+    r"\bINSERT\s+(?:OR\s+\w+\s+)?INTO\s+[\w.\"'`?$:@-]+\s*"
+    r"(?:AS\s+(?:[A-Za-z_][\w$]*|\"(?:\"\"|[^\"])+\")\s*)?(?:\([^)]*\)\s*)?"
+    r"(?:OVERRIDING\s+(?:SYSTEM|USER)\s+VALUE\s+)?(?:VALUES|SELECT|DEFAULT\s+VALUES)\b",
     re.IGNORECASE,
 )
 
@@ -86,6 +88,7 @@ class StoreInsertRequiresOnConflict(Rule):
                 "explicitly replay-named callables in recognized store modules are analyzed."
             ),
             "Dynamic SQL policy composition and ordinary create, seed, migration, schedule, and upsert methods are excluded.",
+            "Target AS aliases and OVERRIDING clauses preserve INSERT detection. Conflict detection remains lexical within one SQL statement; per-CTE ownership is not established by this embedded-SQL rule.",
         ),
         examples=(
             RuleExample(