This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
+12 more
Summary
AI summaryFixed false‑positive inheritance advisories for weak matches and baseless Ruby classes.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Drops inheritance advisory for weakly matched archetype files, reducing false positives. Drops inheritance advisory for weakly matched archetype files, reducing false positives. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Bugfix | Medium |
No longer flags Ruby classes without a base as missing inheritance, aligning with Python behavior. No longer flags Ruby classes without a base as missing inheritance, aligning with Python behavior. Source: llm_adapter@2026-07-18 Confidence: high |
— |
Full changelog
Fixed
- The
inheritance-convention-violationrule was measured ~100% false-positive
across four real repos (45 firings, 0 true positives). Two independent,
false-positive-safe fixes cut the dominant drivers:- A file that resolves to an archetype only by a WEAK match (match_quality
fallback/none, or apath_onlybasis) is not a confident member of that
archetype, so applying its dominant-base convention is noise (a
lib/exceptions.rbpath-matched to a CLI archetype and told to "inherit
Base"). The inheritance advisory is now dropped on such matches. Enforcement
is unaffected and byte-identical: the block path already gates block-eligible
inheritance onconfidence=high+match_quality=ast, and the drop condition
is provably disjoint frommatch_quality=ast, so a weak match never blocks on
inheritance. This eliminated the archetype over-resolution false positives
(Djangoexceptions.py/storage/notifications/providermis-routed to a
test archetype; the mastodonlib/**grab-bag) -- 14 to 2 on Django. - The Ruby inheritance check no longer flags a base-less
class Foo(no
< Base) as a missed inheritance, aligning it to the Python check, which
already exempts a base-lessclass Foo:. Real base-less Ruby classes are
legitimate standalone or mixin-composed classes (a service thatincludes its
behavior, a middleware, a config module), not deviations. A class that extends
the WRONG (non-known) base is still flagged.
- A file that resolves to an archetype only by a WEAK match (match_quality
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Chameleon
All releases →Beta — feedback welcome: [email protected]