Repository navigation
build(labels): pin demangle 0.5.1 so plugins cannot replace built-ins - #383
Merged
Merged
Conversation
demangle 0.5.0 read the demangle.languages entry points on first use, and a plugin registered under a built-in name such as itanium replaced that scheme for every caller in the process, so an unrelated install could change smda's labels. 0.5.1 reads entry points only when a caller calls load_plugins(), which smda never does. The schemes themselves are unchanged between the two releases. The test installs a fake distribution advertising all four names smda uses and checks, in a fresh interpreter, that each still resolves to the built-in. It fails on 0.5.0.
danielplohmann
approved these changes
Oct 14, 2026
danielplohmann
left a comment
danielplohmann
left a comment
Owner
There was a problem hiding this comment.
Approving for 4.10.0. I diffed the 0.5.0 and 0.5.1 wheels and sdists from PyPI. Only __init__.py, api.py, cli.py and core/registry.py changed, and nothing under schemes/, so labels are byte-for-byte the same. Entry points are now read only in load_plugins(), which only the demangle CLI calls and smda never does. There are no new dependencies, no build hooks and no import-time side effects. The new test fails on 0.5.0 (an advertised plugin answered), passes on 0.5.1 in 0.24 s, and turns red again when load_plugins() is forced on 0.5.1, so it would catch a regression. Keeping the exact == pin is right for the label-stability reason in #379.
Nits, take them or leave them:
- A host application in the same process can still call
demangle.load_plugins()/register_language()itself. Itanium, MSVC and Swift then fail silently, with the name left mangled. One sentence in the pin comment would record that. - CHANGELOG: the bullet has no
(#379, #383). "The four demangler modules" is harder to grep than the module names it replaced. And the Cost sentence lost its baseline ("than the native build did").
r0ny123
added a commit
to r0ny123/smda
that referenced
this pull request
Oct 14, 2026
0.6.0 keeps entry points behind load_plugins() and returns the same output as 0.5.1 for all 20,430 names the test suite passes it. The pin comment notes that a host calling load_plugins() or register_language() itself can still replace a scheme. The CHANGELOG entry names the four modules again, restores the native-build baseline for the cost figure and links danielplohmann#379 and danielplohmann#383.
Merged
4 tasks done
danielplohmann
pushed a commit
that referenced
this pull request
Oct 14, 2026
* build(labels): bump demangle to 0.6.0, take #383 review nits 0.6.0 keeps entry points behind load_plugins() and returns the same output as 0.5.1 for all 20,430 names the test suite passes it. The pin comment notes that a host calling load_plugins() or register_language() itself can still replace a scheme. The CHANGELOG entry names the four modules again, restores the native-build baseline for the cost figure and links #379 and #383. * docs(changelog): give the demangle 0.6.0 bump its own entry 0.6.0 moves labels on non-ASCII Itanium and Swift names and on ARM64e MSVC names, none of which the fixtures contain. The #379 entry goes back to describing the 0.5.1 pin it was measured on, and the bump gets its own bullet naming those changes. The pin comment now says a replacing plugin can change labels, not only leave them mangled.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #379, point 6 of the review: an installed plugin should not be able to replace a built-in demangling scheme.
Before: with
demangle==0.5.0, the first demangle call read everydemangle.languagesentry point, and a plugin registered asitanium,msvc,rustorswiftreplaced that scheme for the whole process, so an unrelated package could change smda's labels.After: smda pins
demangle==0.5.1. That release reads entry points only when a caller callsload_plugins(), which smda never does. Its demangling schemes are unchanged from 0.5.0, so labels are the same.tests/testDemangleSchemes.pyinstalls a fake distribution advertising all four names. It then checks in a fresh interpreter that smda's demanglers give their usual answers and that each name still resolves to the built-in scheme. It fails on 0.5.0. The CHANGELOG line for #379 now names the new pin.Full suite: 2,233 passed, 1 skipped. ruff, ruff format and ty are clean.