Testing 5 mini by unnat-deepsource · Pull Request #95 · CyberdyneHQ/demo-python

unnat-deepsource · 2026-04-20T09:09:46Z

No description provided.

deepsource-development · 2026-04-20T09:10:05Z

DeepSource Code Review

We reviewed changes in 9d1323c...f634b03 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade Focus Area: Reliability	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Python		Apr 20, 2026 9:12a.m.	Review ↗
Secrets		Apr 20, 2026 9:12a.m.	Review ↗

deepsource-development · 2026-04-20T09:10:11Z

+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass, field


Unused field imported from dataclasses

An object has been imported but is not used anywhere in the file.
It should either be used or the import should be removed.

deepsource-development · 2026-04-20T09:10:11Z

+        product.quantity += quantity
+        return product
+
+    def get_low_stock(self, categories: list[str] = []) -> list[Product]:


Dangerous default value [] as argument

Do not use a mutable like list or dictionary as a default value to an argument. Python’s default arguments are evaluated once when the function is defined. Using a mutable default argument and mutating it will mutate that object for all future calls to the function as well.

deepsource-development · 2026-04-20T09:10:11Z

+        ]
+        return low
+
+    def bulk_update_prices(self, updates: dict[str, float] = {}) -> int:


Dangerous default value {} as argument

Do not use a mutable like list or dictionary as a default value to an argument. Python’s default arguments are evaluated once when the function is defined. Using a mutable default argument and mutating it will mutate that object for all future calls to the function as well.

deepsource-development · 2026-04-20T09:10:11Z

+        """Remove a product from inventory."""
+        try:
+            return self._products.pop(sku)
+        except:


do not use bare 'except'

Using except without a specific exception can be error prone.

deepsource-development · 2026-04-20T09:10:11Z

+            if normalized in p.name.lower()
+        ]
+
+    def export_snapshot(self, fields: list[str] = []) -> list[dict]:


Dangerous default value [] as argument

Do not use a mutable like list or dictionary as a default value to an argument. Python’s default arguments are evaluated once when the function is defined. Using a mutable default argument and mutating it will mutate that object for all future calls to the function as well.

deepsource-development · 2026-04-20T09:10:12Z

+    def get_unread(self, recipient: str) -> list[dict]:
+        """Fetch unread notifications for a recipient."""
+        conn = self._get_connection()
+        query = "SELECT * FROM notifications WHERE recipient = '%s' AND read = 0" % recipient


Formatting a regular string which could be a f-string

f-strings are the fastest way to format strings as compared to the following methods: * using format specifiers %

deepsource-development · 2026-04-20T09:10:12Z

+                }
+                for row in cursor.fetchall()
+            ]
+        except:


do not use bare 'except'

Using except without a specific exception can be error prone.

deepsource-development · 2026-04-20T09:10:12Z

+    def generate_csv(
+        self,
+        data: list[dict[str, Any]],
+        filters: dict[str, Any] = {},


Dangerous default value {} as argument

Do not use a mutable like list or dictionary as a default value to an argument. Python’s default arguments are evaluated once when the function is defined. Using a mutable default argument and mutating it will mutate that object for all future calls to the function as well.

deepsource-development · 2026-04-20T09:10:12Z

+    def generate_text_summary(
+        self,
+        data: list[dict[str, Any]],
+        columns: list[str] = [],


Dangerous default value [] as argument

Do not use a mutable like list or dictionary as a default value to an argument. Python’s default arguments are evaluated once when the function is defined. Using a mutable default argument and mutating it will mutate that object for all future calls to the function as well.

deepsource-development · 2026-04-20T09:10:12Z

+        lines.append(f"Total: {len(data)} records")
+        return "\n".join(lines)
+
+    def generate_summary_stats(


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

rupin-deepsource · 2026-04-20T09:12:25Z

@deepsourcebot review

deepsource-development · 2026-04-20T09:15:46Z

+        product.quantity += quantity
+        return product
+
+    def get_low_stock(self, categories: list[str] = []) -> list[Product]:


`categories` argument is ignored, breaking caller expectations

get_low_stock accepts categories but never applies it. Callers relying on filtered low-stock alerts may act on incorrect results.

Implement category filtering logic using categories, or remove the parameter and update the docstring to match behavior.

deepsource-development · 2026-04-20T09:15:46Z

+        """Remove a product from inventory."""
+        try:
+            return self._products.pop(sku)
+        except:


Bare `except` hides unexpected runtime failures

remove_product catches every exception, not just missing keys. Real defects in _products handling get swallowed, and callers receive None, obscuring operational failures.

Catch KeyError explicitly, and log unexpected exceptions with logger.exception before re-raising.

deepsource-development · 2026-04-20T09:15:46Z

+                if fields:
+                    entry = {k: v for k, v in entry.items() if k in fields}
+                snapshot.append(entry)
+            except:


Bare `except` suppresses export data errors

export_snapshot catches all exceptions and continues. Corrupted product data can silently drop rows, producing incomplete exports and hidden data-quality defects.

Catch specific expected exceptions, and for unknown exceptions use logger.exception and fail fast or collect explicit error results.

deepsource-development · 2026-04-20T09:15:46Z

+        query = "SELECT * FROM notifications WHERE recipient = '%s' AND read = 0" % recipient
+        try:
+            cursor = conn.execute(query)


`%` string formatting enables SQL injection in `recipient` filter

get_unread builds query using % interpolation, then passes it to conn.execute. Attackers controlling recipient can alter WHERE logic and read other users’ notifications.

Replace string interpolation with a parameterized statement using ? placeholders and pass (recipient,) separately.

deepsource-development · 2026-04-20T09:15:46Z

+        except:
+            logger.error("Failed to fetch notifications for %s", recipient)
+            return []


`except:` swallows database errors and hides failure causes

A bare except: in get_unread suppresses root-cause visibility and masks runtime faults as normal empty results. This can silently break alert delivery logic and delay incident diagnosis.

Catch sqlite3.Error explicitly, log the exception details, and re-raise or return a typed error path distinct from valid empty results.

deepsource-development · 2026-04-20T09:15:46Z

+    def generate_csv(
+        self,
+        data: list[dict[str, Any]],
+        filters: dict[str, Any] = {},


Mutable `{} ` default risks shared state bugs

Using filters: dict[str, Any] = {} creates one shared dictionary for every invocation. If later code mutates it, callers can influence each other and produce hard-to-reproduce failures.

Replace with filters: Optional[dict[str, Any]] = None and initialize filters = {} inside the method

deepsource-development · 2026-04-20T09:15:46Z

+        fieldnames = list(data[0].keys())
+        writer = csv.DictWriter(output, fieldnames=fieldnames)
+        writer.writeheader()
+
+        for record in data:
+            writer.writerow(record)


`csv.DictWriter` raises on rows with extra keys

Using first-row keys as a fixed schema can crash exports when later rows have additional fields. One malformed or richer record stops the entire report and loses output.

Build fieldnames as the union of keys across all records, or configure extrasaction='ignore' to tolerate extra keys

deepsource-development · 2026-04-20T09:15:46Z

+        for record in data:
+            writer.writerow(record)


Unsanitized `writer.writerow` allows spreadsheet formula execution

writer.writerow(record) emits untrusted cell values directly into CSV output. If user-controlled text starts with formula prefixes, spreadsheet clients can execute payloads, enabling data exfiltration or command invocation via client integrations.

Sanitize each string cell before writing by prefixing dangerous leading characters with a quote or tab

deepsource-development · 2026-04-20T09:15:46Z

+        self,
+        data: list[dict[str, Any]],
+        numeric_field: str,
+        group_by: Optional[str] = None,


Unused `group_by` parameter returns incorrect aggregate scope

The implementation ignores group_by, so grouped summaries are never produced despite API and docstring promises. Consumers can trust incorrect results and make wrong inventory decisions.

Implement grouping logic when group_by is provided, returning stats keyed by group value; otherwise keep current global aggregate behavior

rupin-deepsource · 2026-04-20T10:46:35Z

@deepsourcebot review

unnat-deepsource added 2 commits April 20, 2026 13:24

add code

8499f55

cleanup

f634b03

unnat-deepsource requested a review from srijan-deepsource as a code owner April 20, 2026 09:09

deepsource-development Bot reviewed Apr 20, 2026

View reviewed changes

Uh oh!

Conversation

unnat-deepsource commented Apr 20, 2026

Uh oh!

deepsource-development Bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Unused field imported from dataclasses

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Dangerous default value [] as argument

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Dangerous default value {} as argument

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

do not use bare 'except'

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Dangerous default value [] as argument

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Formatting a regular string which could be a f-string

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

do not use bare 'except'

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Dangerous default value {} as argument

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Dangerous default value [] as argument

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Method doesn't use the class instance and could be converted into a static method

Uh oh!

rupin-deepsource commented Apr 20, 2026

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

`categories` argument is ignored, breaking caller expectations

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Bare `except` hides unexpected runtime failures

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Bare `except` suppresses export data errors

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

`%` string formatting enables SQL injection in `recipient` filter

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

`except:` swallows database errors and hides failure causes

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Mutable `{} ` default risks shared state bugs

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

`csv.DictWriter` raises on rows with extra keys

Uh oh!

deepsource-development Bot commented Apr 20, 2026 •

edited

Loading