You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

utils/VersionSuggester.py (1)

45-76: Guard against accidental use of legacy suggest_upgrade_version.

Per prior learning, this was deprecated in favor of suggest_safe_minor_upgrade. Ensure it’s not referenced.

Run:

#!/bin/bash
rg -nP '\bsuggest_upgrade_version\s*\(' -g '!**/dist/**' -g '!**/build/**'

utils/CommunityActivityUtils.py (2)

320-349: Re: prior “Incomplete URL substring sanitization” alert — normalization now anchors on hostname.

_normalize_github_url uses urlparse.hostname and explicit allowlist for github.com/www.github.com, mitigating substring tricks.

---

414-419: Incorrect GitHub GraphQL endpoint (uses github.com instead of api.github.com).

Current code calls https://github.com/graphql which will fail; should be https://api.github.com/graphql.

Apply this diff:

-    gql_url = f"{_GITHUB_API.replace('api.', '')}/graphql"
+    gql_url = f"{_GITHUB_API}/graphql"

utils/VersionSuggester.py (3)

195-207: Narrow exception handling around OSV checks.

Catching Exception hides real failures and trips BLE001. Limit to aiohttp/timeout errors.

Apply this diff:

-    async with aiohttp.ClientSession() as session:
-        sem = asyncio.Semaphore(5)
-        for _, ver_str in candidates:
-            try:
-                _, status, _ = await fetch_osv(session, pkg, ver_str, sem)
-            except Exception as exc:  # pragma: no cover - network safety
-                logger.warning(
-                    f"Failed to verify vulnerabilities for {pkg}=={ver_str}: {exc}"
-                )
-                continue
+    async with aiohttp.ClientSession() as session:
+        sem = asyncio.Semaphore(5)
+        for _, ver_str in candidates:
+            try:
+                _, status, _ = await fetch_osv(session, pkg, ver_str, sem)
+            except (aiohttp.ClientError, asyncio.TimeoutError) as exc:  # pragma: no cover
+                logger.warning("OSV check failed for %s==%s: %s", pkg, ver_str, exc)
+                continue

---

136-141: Allow caller-provided session/semaphore to avoid per-call client creation.

This reduces overhead when scanning many packages (used by OutdatedPackageAnalysis).

Apply this diff:

-async def find_latest_safe_version_for_major(
+async def find_latest_safe_version_for_major(
     pkg: str,
     current_version: str,
     all_versions: list[str],
     target_major: int,
-) -> str | None:
+    session: aiohttp.ClientSession | None = None,
+    sem: asyncio.Semaphore | None = None,
+) -> str | None:
@@
-    async with aiohttp.ClientSession() as session:
-        sem = asyncio.Semaphore(5)
-        for _, ver_str in candidates:
+    own_session = session is None
+    if sem is None:
+        sem = asyncio.Semaphore(5)
+    if own_session:
+        session = aiohttp.ClientSession()
+    try:
+        for _, ver_str in candidates:
             try:
                 _, status, _ = await fetch_osv(session, pkg, ver_str, sem)
             except (aiohttp.ClientError, asyncio.TimeoutError) as exc:  # pragma: no cover - network safety
                 logger.warning(
                     f"Failed to verify vulnerabilities for {pkg}=={ver_str}: {exc}"
                 )
                 continue
@@
-    return None
+    finally:
+        if own_session and session:
+            await session.close()
+    return None

Also applies to: 195-209

---

110-127: Optional: check candidates concurrently (bounded) for faster results.

You can fire a small batch (e.g., top 8) with asyncio.as_completed under the same semaphore; stop on first “No”.

I can provide a concrete patch if you’d like this optimization.

utils/CommunityActivityUtils.py (4)

61-63: Narrow cache init exception and log why cache is ignored.

Avoid bare Exception and silent fallback.

Apply this diff:

-try:
-    _ETAG_CACHE = json.loads(_CACHE_PATH.read_text(encoding="utf-8"))
-except Exception:
-    _ETAG_CACHE = {}  # {key: {"etag": "...", "last_modified": "...", "payload": {...}, "fetched_at": "..."}}
+try:
+    _ETAG_CACHE = json.loads(_CACHE_PATH.read_text(encoding="utf-8"))
+except (OSError, json.JSONDecodeError) as exc:
+    logger.debug("Initializing GitHub cache failed: %s", exc)
+    _ETAG_CACHE = {}  # {key: {"etag": "...", "last_modified": "...", "payload": {...}, "fetched_at": "..."}}

---

83-86: Do not swallow cache write failures.

Log at debug to aid diagnosability.

Apply this diff:

-    try:
-        _CACHE_PATH.write_text(json.dumps(_ETAG_CACHE), encoding="utf-8")
-    except Exception:
-        pass
+    try:
+        _CACHE_PATH.write_text(json.dumps(_ETAG_CACHE), encoding="utf-8")
+    except OSError as exc:
+        logger.debug("Writing GitHub cache failed: %s", exc)

---

285-295: Overbroad try/except in host check.

urlparse won’t raise here; remove blanket except to avoid masking bugs.

Apply this diff:

-def _is_github_host(url: str) -> bool:
-    try:
-        parsed = urlparse(url)
-        hostname = parsed.hostname
-        if not hostname:
-            return False
-        hostname = hostname.lower()
-        return hostname == "github.com" or hostname.endswith(".github.com")
-    except Exception:
-        return False
+def _is_github_host(url: str) -> bool:
+    parsed = urlparse(url)
+    hostname = (parsed.hostname or "").lower()
+    return hostname == "github.com" or hostname.endswith(".github.com")

---

450-457: Minor: rename unused loop variable to underscore to satisfy linters.

No behavior change.

Apply this diff:

-    for attempt in range(max_retries):
+    for _attempt in range(max_retries):
@@
-    for attempt in range(max_retries):
+    for _attempt in range(max_retries):

Also applies to: 513-520

OutdatedPackageAnalysis.py (2)

268-281: Process packages concurrently with a bounded semaphore.

Significantly reduces wall-clock time while respecting external rate limits.

Apply this diff:

-async def _generate_reports(
-    packages: list[tuple[str, str]],
-) -> list[PackageReport]:
-    """Process packages sequentially and collect report rows."""
-
-    results: list[PackageReport] = []
-    total = len(packages)
-    for idx, (name, version_str) in enumerate(packages, start=1):
-        logger.info("[%d/%d] Evaluating %s==%s", idx, total, name, version_str)
-        report = await _process_package(name, version_str)
-        if report:
-            results.append(report)
-    return results
+async def _generate_reports(
+    packages: list[tuple[str, str]],
+) -> list[PackageReport]:
+    """Process packages concurrently with a small cap."""
+    sem = asyncio.Semaphore(5)
+    total = len(packages)
+
+    async def run_one(idx: int, name: str, version_str: str) -> PackageReport | None:
+        async with sem:
+            logger.info("[%d/%d] Evaluating %s==%s", idx, total, name, version_str)
+            return await _process_package(name, version_str)
+
+    tasks = [run_one(i, n, v) for i, (n, v) in enumerate(packages, start=1)]
+    results = await asyncio.gather(*tasks)
+    return [r for r in results if r]

---

286-294: Clarify CSV header label.

Header says “Is Major/Second Major Version” but code may emit “Current Major”. Make the header explicit.

Apply this diff:

-        "Is Major/Second Major Version",
+        "Target Major (Latest/Second/Current)",

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: TongWu
PR: TongWu/PythonPackageManager#14
File: utils/VersionSuggester.py:136-137
Timestamp: 2025-06-24T03:17:27.150Z
Learning: In utils/VersionSuggester.py, the suggest_upgrade_version function has been intentionally disabled as it's outdated. The preferred approach is to use suggest_safe_minor_upgrade function instead for version suggestions.