Skip to content

Chameleon

v4.4.2 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-coding-assistant archetype ast-analysis claude-code claude-plugin code-conventions
+12 more
code-review code-style developer-tools javascript linter mcp mcp-server prompt-engineering python ruby rails typescript

Summary

AI summary

Fixed false-positive lint notes for unchanged exports, default-export-kind mismatch in mixed modules, exempted Django unittest hooks from snake_case rule, ignored explicit object base classes in Python, and stopped suggesting class-bound members as reusable imports.

Changes in this release

Bugfix Medium

Suppress Ruby/Python default-export-kind mismatch when expected construct absent.

Suppress Ruby/Python default-export-kind mismatch when expected construct absent.

Source: llm_adapter@2026-07-17

Confidence: high

Bugfix Medium

Exempt Django `TestCase` hook methods from snake_case naming rule.

Exempt Django `TestCase` hook methods from snake_case naming rule.

Source: llm_adapter@2026-07-17

Confidence: high

Bugfix Medium

Treat `class Foo(object):` as equivalent to `class Foo:` in Python 3, avoiding missed inheritance false positive.

Treat `class Foo(object):` as equivalent to `class Foo:` in Python 3, avoiding missed inheritance false positive.

Source: llm_adapter@2026-07-17

Confidence: high

Bugfix Medium

Prevent class‑bound members from being suggested as reusable import targets in the reuse-before-create nudge.

Prevent class‑bound members from being suggested as reusable import targets in the reuse-before-create nudge.

Source: llm_adapter@2026-07-17

Confidence: high

Bugfix Medium

Eliminate repeated “N files import X” notes in `posttool_verify` for edits that do not affect imports.

Eliminate repeated “N files import X” notes in `posttool_verify` for edits that do not affect imports.

Source: llm_adapter@2026-07-17

Confidence: high

Full changelog

Fixed

  • Per-edit PostToolUse no longer repeats the "N files import X" cross-file
    importer note for an export the edit left in place. That note is
    edit-independent static context already delivered pre-edit by the "Inbound
    callers" section, so on a large module every additive edit re-listed one note
    per exported symbol, all about symbols the change never touched — the dominant
    per-edit noise source. posttool_verify now drops it on BOTH the daemon and
    in-process lint paths; the removed-export existence break, the explicit
    lint_file tool, the Stop backstop, and Bash-writes still see the full
    importer surface.
  • The Ruby/Python default-export-kind mismatch no longer fires on a
    mixed-construct module that does not actually define the expected construct.
    Ruby and Python have no single default export, so the shape is a best-effort
    "primary construct" guess; the check now suppresses when the expected
    construct is absent from the file's top-level kinds. TypeScript, which has a
    genuine unique default export, is unchanged.
  • unittest / Django TestCase hook methods (setUp, tearDown, setUpClass,
    setUpTestData, asyncSetUp, and the rest) are exempt from the Python
    snake_case method-naming rule. They are framework-mandated camelCase a class
    must match exactly, so flagging them was an unfixable false positive.
  • A Python class Foo(object): is no longer read as a missed inheritance. It is
    identical to class Foo: in Python 3, which the check already left alone, so
    an explicit universal object base is not a deviation (the extension-point
    wrapper false positive).
  • The pre-write reuse-before-create nudge no longer offers a class-bound member
    as an importable "reuse" target. A method, classmethod, staticmethod, Ruby
    def self.x, TypeScript constructor, or TypeScript get/set accessor is scoped
    to its class — "import and reuse it" only fits a free, module-level function,
    so a same-named class member on another class (expired on a queryset,
    perform on a service) was wrong advice. The softer semantic pass still
    surfaces a renamed near-duplicate, and genuine body duplication is still
    caught at turn end.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Chameleon

Get notified when new releases ship.

Sign up free

About Chameleon

All releases →

Related context

Earlier breaking changes

  • v3.0.0 MCP surface folded from 48 tools to 19; remaining 32 operator tools become actions on three dispatchers.

Beta — feedback welcome: [email protected]