Skip to content

mollify 0.1.3

Choose a tag to compare

View all tags
@FavioVazquez FavioVazquez released this 01 Jul 21:24
· 70 commits to main since this release
v0.1.3
9a71aa9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's new in 0.1.3

Precision release: a real-world audit surfaced a cluster of false positives whose
root causes are fixed here (on a fixture reproducing the audited patterns, the
score moved from 20/100 to 95/100). Two new ADRs document the core graph-semantic
changes (ADR-0002,
ADR-0003).

Fixed

Precision pass from a real-world audit (running mollify on an external Python
package) that surfaced these false positives:

  • Relative imports in a package __init__.py now resolve. A package's
    __init__.py has the package itself as its dotted name, so the resolver was
    dropping one segment too many — .aa resolved to aa instead of pkg.aa.
    This cascaded into spurious unresolved-import → unused-file →
    unused-export across re-exporting packages (the dominant FP source). Package
    self-references no longer create a circular-dependency.
  • session.exec(...) no longer flagged dangerous-eval (CWE-95). The
    security rule matched any trailing .exec/.eval segment; it now matches only
    the eval/exec/compile builtins, not ORM/driver methods.
  • pytest test_*/Test* are no longer unused-export. They are treated as
    reachability roots within test paths, honoring
    [tool.pytest.ini_options].testpaths.
  • from __future__ import … is no longer unused-import (it has a compiler
    effect and is never unused).
  • Lazy/in-function imports now count toward dependency usage and
    reachability, so a dependency imported only inside main() (e.g. uvicorn)
    isn't falsely unused-dependency; module-scope unused-import is unaffected.
  • [project.scripts] entry points are reachability roots — the target
    module isn't unused-file and the named function isn't unused-export.
  • First-party test helpers imported by bare leaf name (conftest, sibling
    modules on a test path) are no longer missing-dependency.
  • commented-code no longer fires on prose that opens with a keyword
    (e.g. # from zero (...), doubled.); from … now requires a real import.

Changed

  • Quality score is weighted by confidence — uncertain findings penalize
    the 0–100 score far less than certain ones, so a report dominated by
    low-confidence review items no longer reads as a failing grade. Still
    deterministic.
  • mollify init writes a richer, documented starter .mollifyrc.json
    (five-area severities, type-health off by default, complexity knobs,
    inline _comment docs).

Added

  • --include <DIR> flag on all 8 analysis commands (audit, dead-code,
    deps, arch, complexity, dupes, types, security; not
    coverage/supply-chain, which aren't path-scoped). Repeatable; overrides
    the builtin discovery denylist (.venv, .git, __pycache__,
    node_modules, build, dist, etc.), .mollifyrc.json's exclude_dirs,
    and .gitignore for the named directory, letting users opt a directory
    back into scanning on a per-invocation basis. Does not override the
    pyvenv.cfg virtualenv guard — an included directory that is itself a
    virtualenv stays excluded.

Install / upgrade

uvx mollify@0.1.3 audit        # or: uv tool install mollify
pip install --upgrade mollify
cargo install mollify-cli      # binary: mollify

Full changelog: https://github.com/FavioVazquez/mollify/blob/v0.1.3/CHANGELOG.md

Assets 2
Loading