docs(registry): the fabricated-edge blind spot is cross-language, not Python - #73
Merged
Merged
Conversation
… Python journeys/testgraph.json described the append spot-check's fabricated edges as a defect in codegraph's Python resolver. That understates it, and testgraph is public now, so the claim is one a stranger reads. Reproduced on 1.5.0 and 1.6.0 in three languages, same exact-match signature each time, each with a plain-identifier control that resolves correctly: python d.setdefault(k, []).append(v) -> unrelated top-level append js m.getOrInit(k, []).push(v) -> unrelated top-level push go r.lookup(k).Get(v) -> package-level Get, not Bag.Get So it is the shared extractor dropping any non-identifier receiver, not a Python heuristic. Go also shows it is not confined to collection-method names: Get collides with an ordinary package-level function, which widens the exposed surface to any repo where a method name is also a top-level function name. Filed upstream with patches: colbymchenry/codegraph#1683 (the fabrication) and #1681 (the module-member false negative). No behavior change here - the append spot-check is already suspended, so nothing was returning a false green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
journeys/testgraph.jsondescribed theappendspot-check's fabricated edges as a defect in codegraph's Python resolver. That understates it — and testgraph is public now, so it is a claim strangers read.Reproduced on 1.5.0 and 1.6.0 in three languages, same
exact-matchsignature each time, each with a plain-identifier control that resolves correctly:d.setdefault(k, []).append(v)appendm.getOrInit(k, []).push(v)pushr.lookup(k).Get(v)Get, notBag.GetSo it is the shared extractor dropping any non-identifier receiver, not a Python heuristic. Go also shows it is not confined to collection-method names —
Getcollides with an ordinary package-level function, which widens the exposed surface to any repo where a method name is also a top-level function name.Filed upstream with patches: colbymchenry/codegraph#1683 (the fabrication) and #1681 (the module-member false negative).
No behavior change — the
appendspot-check is already suspended, so nothing was returning a false green.Ran 264 tests, OK.