This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
+12 more
Summary
AI summaryFixed false‑positive linting issues for JSX attributes, Python property decorators, calibration demotion, and inheritance conventions.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Style lint no longer flags double-quoted JSX attribute values when using Prettier's jsxSingleQuote setting. Style lint no longer flags double-quoted JSX attribute values when using Prettier's jsxSingleQuote setting. Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Bugfix | Medium |
Python property accessor rules no longer flag @property, @cached_property, @computed_field, or setter methods as violating snake_case naming. Python property accessor rules no longer flag @property, @cached_property, @computed_field, or setter methods as violating snake_case naming. Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Bugfix | Low |
Inheritance‑convention lint now renders demoted false‑positive cases as advisory notes instead of mandatory fixes. Inheritance‑convention lint now renders demoted false‑positive cases as advisory notes instead of mandatory fixes. Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Bugfix | Low |
Inheritance‑convention lint stops flagging multiple sibling classes sharing a common base class in the same file. Inheritance‑convention lint stops flagging multiple sibling classes sharing a common base class in the same file. Source: llm_adapter@2026-07-17 Confidence: high |
— |
Full changelog
Fixed
- Style lint no longer flags a double-quoted JSX attribute value
(className="x"). prettier'sjsxSingleQuotegoverns JSX quoting separately
and defaults to false, so JSX attributes stay double-quoted even under
singleQuote: true— flagging them steered the model to break
prettier-conforming code (the single highest-frequency false positive across
the framework audit). The skip fires only when the file actually contains JSX
(so a compactconst x="y"assignment in a plain.js/.tsfile still flags,
and a TS generic likeArray<string>never fools the detector), and honors an
explicitjsxSingleQuote: true. - The Python method snake_case rule no longer flags a
@property/
@cached_property/@computed_field/@x.setteraccessor. A property is an
attribute accessor, so its name follows attribute/constant casing (a pydantic
@computed_fieldnamedSQLALCHEMY_DATABASE_URI), not function snake_case. A
comment between the decorator and itsdefno longer defeats the exemption. - A rule calibration demoted for flagging conforming committed code
(enforcement.jsonactive:falsewithflagged>0, e.g. inheritance-convention
on a DRFFlexFieldsModelSerializer) now renders as an advisory note rather
than an imperative "Fix these." — the calibration layer already measured it as
false-positive-prone, so its per-edit firings no longer carry the
conformance-failure tone or ratchet per-file escalation. Security rules are
never demoted. - The inheritance-convention lint no longer flags a cohort of classes that
deliberately share a base the archetype's per-file derivation never admitted to
known_bases(six sibling DRF serializers extendingFlexFieldsModelSerializer
in one file). A base ≥2 top-level classes in the edited file inherit as their
primary base is exempted; a lone off-base class, and a class whose primary base
deviates while only a secondary mixin is shared, still flag.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Chameleon
All releases →Beta — feedback welcome: [email protected]