Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
.. image:: https://raw.githubusercontent.com/KotlinIsland/basedmypy/master/docs/static/logo-light.png
Basedmypy is a type checker that is built on top of the work done by the
mypy project <https://github.com/python/mypy>
_. It adds based functionality and breaks compatibility with
the cringe parts of pep 484.
Basedmypy has baseline, baseline is based! It allows you to adopt new strictness or features without the burden of fixing up every usage, just save all current errors to the baseline file and deal with them later.
Consider the following:
.. code-block:: python
def foo(a):
print(a)
.. code-block:: text
> mypy demo.py
demo.py:1: error: missing typehints
Failed: errors found in source file
> mypy --write-baseline demo.py
demo.py:1: error: missing typehints
Baseline successfully written to .mypy/baseline.json
> mypy demo.py
Success: no issues found in 1 source file
Then on subsequent runs the existing errors will be filtered out:
.. code-block:: python
def foo(a):
print(a)
def bar(b: str, c: int) -> bool:
return b + c
.. code-block:: text
> mypy demo.py
demo.py:4:5: error: Returning Any from function declared to return "bool" [no-any-return]
demo.py:4:16: error: Unsupported operand types for + ("str" and "int") [operator]
Found 2 errors in 1 file (checked 1 source file)
Using the &
operator or basedtyping.Intersection
you can denote intersection types:
.. code-block:: python
class Growable(ABC, Generic[T]):
@abstractmethod
def add(self, item: T): ...
class Resettable(ABC):
@abstractmethod
def reset(self): ...
def f(x: Resettable & Growable[str]):
x.reset()
x.add("first")
Mypy joins types to their common base type:
.. code-block:: python
a: int
b: str
reveal_type(a if bool() else b) # Revealed type is "builtins.object"
Basedmypy joins types into unions instead:
.. code-block:: python
a: int
b: str
reveal_type(a if bool() else b) # Revealed type is "int | str"
Literal
is so cumbersome! just use a bare literal instead:
.. code-block:: python
class Color(Enum):
RED = auto()
a: 1 | 2
b: True | Color.RED
The default return type of functions is None
instead of Any
:
(configurable with the default_return
option.)
.. code-block:: python
def f(name: str):
print(f"Hello, {name}!")
reveal_type(f) # (str) -> None
TypeVar
BoundsAllows the bounds of TypeVar
\s to be generic.
So you are able to have functions with polymorphic generic parameters.
.. code-block:: python
E = TypeVar("E")
I = TypeVar("I", bound=Iterable[E])
def foo(i: I, e: E) -> I:
assert e not in i
return i
reveal_type(foo(["based"], "mypy")) # N: Revealed type is "list[str]"
reveal_type(foo({1, 2}, 3)) # N: Revealed type is "set[int]"
The types in overload implementations (including properties) can be inferred:
.. code-block:: python
@overload
def f(a: int) -> str: ...
@overload
def f(a: str) -> int: ...
def f(a):
reveal_type(a) # int | str
return None # error: expected str | int
class A:
@property
def foo(self) -> int: ...
@foo.setter
def foo(self, value): ... # no need for annotations
Infer the type of a function parameter from it's default value:
.. code-block:: python
def f(a=1, b=True):
reveal_type((a, b)) # (int, bool)
Basedmypy allows denotation of tuple types with tuple literals:
.. code-block:: python
a: (int, str) = (1, "a")
Basedmypy makes significant changes to error and info messages, consider:
.. code-block:: python
T = TypeVar("T", bound=int)
def f(a: T, b: list[str | 1 | 2]) -> Never:
reveal_type((a, b))
reveal_type(f)
Mypy shows::
Revealed type is "Tuple[T`-1, Union[builtins.str, Literal[1], Literal[2]]]"
Revealed type is "def [T <: builtins.int] (a: T`-1, b: Union[builtins.str, Literal[1], Literal[2]]) -> <nothing>"
Basedmypy shows::
Revealed type is "(T@f, str | 1 | 2)"
Revealed type is "def [T: int] (a: T, b: str | 1 | 2) -> Never"
FAQs
Based static typing for Python
We found that basedmypy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.