You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The constant-only raw_sql_concat exemption (v4.4.20) worked for TypeScript
ONLY; Ruby and Python were silently unprotected. _interpolates_only_constants
extracted the interpolation slot with next(g for g in groups if g is not None),
but re.findall on the multi-group alternation returns '' (empty string), not None, for groups that did not participate -- so it always picked group 1 (the
TS ${...} slot) and read the Ruby #{...} / Python {...} slot as empty. A
Rails/Django repositories cohort building safe SQL from a #{TABLE} / {COLUMNS}
module constant therefore still tripped raw_sql_concat, still lost its canonical
witness, and (via the paired v4.4.21 change) was emitted witnessless -- the exact
regression the exemption was written to prevent, in two of the three languages.
Fixed by testing the slot on truthiness (next((g for g in groups if g), "")),
which selects the group that actually matched and falls through safely on an
empty ${}. Found by the step-7 clean-code review.