Repository navigation
[suspicious] Add shared-clock-mock - #29074
Merged
Merged
Conversation
charliermarsh
temporarily deployed
to
automations
October 2, 2026 15:08 — with
GitHub Actions
Inactive
|
| code | total | + violation | - violation | + fix | - fix |
|---|---|---|---|---|---|
| shared-clock-mock | 529 | 529 | 0 | 0 | 0 |
charliermarsh
marked this pull request as ready for review
October 26, 2026 16:36
charliermarsh
temporarily deployed
to
automations
October 26, 2026 16:39 — with
GitHub Actions
Inactive
Contributor
|
| code | total | + violation | - violation | + fix | - fix |
|---|---|---|---|---|---|
| shared-clock-mock | 601 | 601 | 0 | 0 | 0 |
Results for 3d2e962 Β· Workflow run
ntBre
approved these changes
Oct 26, 2026
charliermarsh
temporarily deployed
to
automations
October 26, 2026 18:05 — with
GitHub Actions
Inactive
charliermarsh
temporarily deployed
to
automations
October 26, 2026 18:15 — with
GitHub Actions
Inactive
rlichtenwalter
added a commit
to rlichtenwalter/dir2text
that referenced
this pull request
Oct 30, 2026
This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [DavidAnson/markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) | repository | minor | `v0.23.3` β `v0.24.0` |  |  | | [ruff](https://docs.astral.sh/ruff) ([source](https://github.com/astral-sh/ruff), [changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)) | dependency-groups | patch | `==0.17.1` β `==0.17.3` |  |  | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>DavidAnson/markdownlint-cli2</summary> ### [`v0.24.0`](DavidAnson/markdownlint-cli2@v0.23.3...v0.24.0) [Compare Source](DavidAnson/markdownlint-cli2@v0.23.3...v0.24.0) </details> <details> <summary>astral-sh/ruff (ruff)</summary> ### [`v0.17.3`](https://github.com/astral-sh/ruff/blob/HEAD/CHANGELOG.md#0173) [Compare Source](astral-sh/ruff@0.17.2...0.17.3) Released on 2026-10-26. ##### Preview features - \[`suspicious`] Add `shared-clock-mock` ([#​29074](astral-sh/ruff#29074)) ##### Bug fixes - \[`pyupgrade`] Avoid incorrect conversions to f-strings (`UP032`) ([#​25485](astral-sh/ruff#25485)) ##### Performance - Buffer stdout in `ruff format` ([#​29631](astral-sh/ruff#29631)) - Specialize ASCII identifier lexing ([#​29503](astral-sh/ruff#29503)) - Speed up identifier and keyword lexing ([#​29463](astral-sh/ruff#29463)) ##### Documentation - \[`flake8-bandit`] Describe what the rule actually checks for `httpx` (`S113`) ([#​27936](astral-sh/ruff#27936)) ##### Contributors - [@​itsvedantkumar](https://github.com/itsvedantkumar) - [@​charliermarsh](https://github.com/charliermarsh) - [@​anishgirianish](https://github.com/anishgirianish) ### [`v0.17.2`](https://github.com/astral-sh/ruff/blob/HEAD/CHANGELOG.md#0172) [Compare Source](astral-sh/ruff@0.17.1...0.17.2) Released on 2026-10-22. ##### Preview features - \[`complexity`] Add `unnecessary-regular-expression-compile` ([#​25533](astral-sh/ruff#25533)) ##### Bug fixes - Avoid syntax errors for type variables with starred constraints (`UP040`, `UP046`, `UP047`, `RUF053`) ([#​28362](astral-sh/ruff#28362)) - \[`pydocstyle`] Treat backslash-escaped `*args` and `**kwargs` as documented (`D417`) ([#​29536](astral-sh/ruff#29536)) - \[`pylint`] Avoid false positive on starred elements (`PLE0643`) ([#​29483](astral-sh/ruff#29483)) - \[`pylint`] Mark fixes unsafe when deleting comments (`PLR5501`, `PLW0120`) ([#​29414](astral-sh/ruff#29414)) - \[`pyupgrade`] Mark fix unsafe when deleting comments (`UP035`) ([#​29413](astral-sh/ruff#29413)) ##### Performance - Avoid intermediate names in lint name resolution ([#​29506](astral-sh/ruff#29506)) - Prefilter bidirectional Unicode checks by UTF-8 leading bytes ([#​29561](astral-sh/ruff#29561)) - Share postfix parsing and reduce expression copies ([#​29480](astral-sh/ruff#29480)) ##### Configuration - \[`pylint`] Add a configurable allowlist for `magic-value-comparison` (`PLR2004`) ([#​18961](astral-sh/ruff#18961)) ##### Documentation - Clarify documentation and correct stale guidance ([#​29374](astral-sh/ruff#29374)) - \[`pyupgrade`] Remove mentions of variance related to fix safety (`UP040`, `UP047`) ([#​29592](astral-sh/ruff#29592)) ##### Contributors - [@​fixfon](https://github.com/fixfon) - [@​MichaReiser](https://github.com/MichaReiser) - [@​zaniebot](https://github.com/zaniebot) - [@​FrancescoPezzella](https://github.com/FrancescoPezzella) - [@​anishgirianish](https://github.com/anishgirianish) - [@​rajveer3x](https://github.com/rajveer3x) - [@​charliermarsh](https://github.com/charliermarsh) - [@​LckyLike](https://github.com/LckyLke) - [@​DaniBodor](https://github.com/DaniBodor) </details> --- ### Configuration π **Schedule**: (in timezone America/Denver) - Branch creation - Between 02:00 AM and 06:59 AM, only on Tuesday (`* 2-6 * * 2`) - Automerge - At any time (no schedule defined) π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. π» **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNDguMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE0OC4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==--> Reviewed-on: https://git.lichtenwalter.site/rlichten/dir2text/pulls/100
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds a
shared-clock-mockrule in preview. Patching a clock or sleep function on a shared module can affect unrelated threads or tasks, including when the target is qualified with the consuming module:Instead, you should replace the consuming module's binding to keep the fake local:
We also flag patches of wall-clock, monotonic, and performance-counter readings, plus
asyncio.sleep. The rule recognizespatch,patch.object, pytest-mock fixtures, andmonkeypatch.setattr/delattr. (Nested.timeand.asynciotargets use a naming heuristic, so a fixture that already installed a private clock can produce a false positive.)Case analysis
The ecosystem run adds 601 diagnostics across eight projects.
Counting sleep calls in LangChain
This reduced version of LangChainβs device-login test records the polling interval before and after the server asks the client to slow down.
The OAuth module does
import time, sooauth_module.timeandtimeare the same object. If another thread callstime.sleep(1)between the two polls, the recorder sees[2.0, 1, 7.0]. InstallingSimpleNamespace(sleep=sleeps.append)onoauth_module.timekeeps that call out of the list.Running out of clock readings in Superset
Superset tests how long a screenshot request waits for a lock. It patches
superset.dashboards.api.time.monotonicwithside_effect=[10.0, 10.5, 11.0]and patchestime.sleepon the same module. An unrelatedtime.monotonic()can consume the next reading. The request can then see the deadline early or exhaust the iterator and raiseStopIteration. A private clock forsuperset.dashboards.apineeds bothmonotonicandsleep.Retrying an async request in Prefect
Prefect simulates three failed SQS requests and expects one two-second backoff. The test uses
@patch("prefect_aws.observers.ecs.asyncio.sleep"), but the observer doesimport asyncio. A second task awaitingasyncio.sleep(0)would also call the mock and breakassert_called_once_with(2).A fixture that already installed a private clock
Ruff can see the same patch in two tests even though only one reaches the shared module. For example, an autouse fixture can replace
worker.timebefore the test starts.The warning in
test_retryis a false positive. At runtime the receiver is the fixtureβsSimpleNamespace. If the fixture returns that namespace, the test can usemonkeypatch.setattr(private_clock, "sleep", sleep)and Ruff accepts it.A package with its own
timemoduleGevent ships a
gevent.timemodule with its ownsleepbinding. The dotted string is enough for Ruff to flag this reduced example.The assertion passes. Callers that look up
gevent.time.sleepsee the patch. A caller of standard-librarytime.sleepstill gets the original function. Ruff infers the owner from the.time.sleepsuffix in a string target, so it reports the wrong module here.