Use .public_send instead of .send for calls to public methods - #23474
Merged
MikeMcQuaid merged 1 commit intoAug 8, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR replaces uses of Ruby’s .send with .public_send at call sites where the dynamically-invoked method is intended to be public, making the visibility expectation explicit and preventing accidental invocation of private APIs.
Changes:
- Update dynamic color/style method invocation on
Ttyto use.public_send. - Update dynamic spec/field access (e.g.
:stable,:head, arch/version accessors) to use.public_send. - Update dynamic diagnostic check dispatch to use
.public_send.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| Library/Homebrew/utils/formatter.rb | Uses Tty.public_send for dynamic formatting methods instead of send. |
| Library/Homebrew/test_bot/test_formulae.rb | Uses formula.public_send(spec_name) for dynamic spec access. |
| Library/Homebrew/livecheck/livecheck.rb | Uses public_send when dynamically selecting :stable/:head on Formula. |
| Library/Homebrew/formulary.rb | Uses public_send when dynamically selecting the resolved spec on a formula. |
| Library/Homebrew/formula.rb | Uses public_send when dynamically selecting a DSL spec on the formula class. |
| Library/Homebrew/exceptions.rb | Uses public_send when dispatching diagnostic checks by name. |
| Library/Homebrew/dev-cmd/bump.rb | Uses public_send for dynamic access to BumpVersionParser version components. |
| Library/Homebrew/dev-cmd/bump-cask-pr.rb | Uses public_send for dynamic access to arch-specific version components. |
| Library/Homebrew/dev-cmd/bottle.rb | Uses public_send for dynamic access to bottle spec fields and comparisons. |
| Library/Homebrew/compilers/compiler_selector.rb | Uses public_send for dynamically-selected *_build_version methods on DevelopmentTools. |
| Library/Homebrew/cask/audit.rb | Uses cask.public_send(sym) for required stanza checks. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Contributor
Author
Welcome |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
While going through the codebase for calls that use .send to invoke a method by a dynamic name, I found a batch of spots where the method being called is actually public .send was being used just to look up a method whose name isn't known until runtime (e.g. Tty.send(color), formula.send(spec_name)), not because anything private needed to be reached.
Since .send bypasses Ruby's private visibility check entirely, using it on public methods is a bit misleading to read — it makes a caller look like it might be reaching into internals when it isn't. public_send does the exact same dynamic lookup but only succeeds if the method is actually public, so it documents that intent and behaves identically here since every method involved already was public.
For each of the 20 call sites, I checked the receiver's class definition to confirm the method has no private marker before switching it over, so this should be a no-op behavior-wise.
Left untouched (need private access, so can't switch):
pour_bottle_check.rb - calls define_method, always private
api_hashable.rb - calls remove_const, always private
cli/parser.rb - calls a dynamically-named legacy _args method that may be defined by third-party tap commands; couldn't confirm it's always public, so left as-is to avoid breaking external taps
Note: This was the PR already raised and Maintainer has asked to force push once again, I have used Claude Sonnet 5 only to change in code and carefully reviewed it before pushing and this PR was raised by myself and no AI is involved in writing the pr.
brewcommands to reproduce the bug?brew lgtm(style, typechecking and tests) locally?