Type Annotations for RestrictedPython #303

loechel · 2025-10-18T08:32:26Z

I signed and returned the Zope Contributor Agreement, and received and accepted an invitation to join a team in the zopefoundation GitHub organization.
I verified there aren't any other open pull requests for the same change.
I followed the guidelines in Developer guidelines.
I successfully ran code quality checks on my changes locally.
I successfully ran tests on my changes locally.
If needed, I added new tests for my changes.
If needed, I added documentation for my changes.
I included a change log entry in my commits.

If your pull request closes an open issue, include the exact text below, immediately followed by the issue number. When your pull request gets merged, then that issue will close automatically.

Closes #

Copilot

Pull Request Overview

This PR adds type annotations to the RestrictedPython library to improve type safety and developer experience. The changes include comprehensive type annotations for classes, methods, and functions throughout the codebase, along with updates to support Python 3.14.

Added complete type annotations to transformer.py including method signatures and return types
Updated compile.py with proper type annotations using typing module imports
Added version compatibility checks for Python 3.13+ and dropped Python 3.9 support

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tox.ini	Updated Python version references from 3.11 to 3.14 for testing environments
src/RestrictedPython/transformer.py	Added comprehensive type annotations to all methods and functions in the RestrictingNodeTransformer class
src/RestrictedPython/compile.py	Added type annotations and imports for compile functions with proper type aliases
src/RestrictedPython/_compat.py	Added version compatibility flags for Python 3.13 and 3.14
src/RestrictedPython/Utilities.py	Added type annotations to the reorder function with proper collection types
setup.py	Updated Python version support, removed 3.9, added 3.14, and included typing metadata
.meta.toml	Updated test environment dependencies to use py314-datetime instead of py311-datetime

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-18T08:33:33Z

src/RestrictedPython/transformer.py

                keywords=[])

-        elif isinstance(slice_, ast.ExtSlice):
+        elif isinstance(slice_, ast.Tuple):


This code change from ast.ExtSlice to ast.Tuple may be incorrect. In Python 3.9+, ast.ExtSlice was deprecated and replaced with ast.Tuple, but this needs verification against the minimum Python version support. Since the PR drops Python 3.9 support and requires 3.10+, this change should be correct, but the comment on line 416 still mentions 'Index, Slice and ExtSlice' which is now outdated.

src/RestrictedPython/transformer.py

Copilot · 2025-10-18T08:33:34Z

src/RestrictedPython/Utilities.py

+def reorder(s: Iterable, with_: Iterable | None = None,
+            without: Iterable | None = None) -> Iterable:


The default value for without parameter is changed from () (empty tuple) to None, but the function implementation expects a sequence. This could cause runtime errors when without=None is passed and the function tries to iterate over it.

Copilot

Pull Request Overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-18T09:23:52Z

src/RestrictedPython/transformer.py

                keywords=[])

-        elif isinstance(slice_, ast.ExtSlice):
+        elif isinstance(slice_, (ast.Tuple, ast.ExtSlice)):


The condition isinstance(slice_, (ast.Tuple, ast.ExtSlice)) may be incorrect. In Python 3.9+, ast.ExtSlice was removed and its functionality merged into ast.Tuple. This change should be conditional based on Python version or simplified to handle the version differences properly.

The assertion is not correct. I just checked manually and ast.ExtSlice was deprecated in Python 3.9 but it is still documented as existing in 3.14.

Copilot · 2025-10-18T09:23:52Z

src/RestrictedPython/transformer.py

+    def visit_TryStar(self, node: ast.AST) -> ast.AST:
+        """Disallow `ExceptionGroup` due to a potential sandbox escape.
+
+        TODO: Type Annotation for node when dropping support
+              for Python < 3.11 should be ast.TryStar.
+        """


Since Python 3.9 support has been dropped in this PR and the minimum version is now 3.10, the type annotation for node should be updated to ast.TryStar | None or a more specific type, as ast.TryStar was introduced in Python 3.11. The TODO comment should be addressed given the version requirement changes.

Suggested change

def visit_TryStar(self, node: ast.AST) -> ast.AST:

"""Disallow `ExceptionGroup` due to a potential sandbox escape.

TODO: Type Annotation for node when dropping support

for Python < 3.11 should be ast.TryStar.

"""

def visit_TryStar(self, node: ast.TryStar) -> ast.AST:

"""Disallow `ExceptionGroup` due to a potential sandbox escape."""

dataflake · 2025-10-18T09:54:30Z

Please do not unilaterally remove Python 3.9 support. This is done in concert with all other ZF packages.

…mer to start looking into it

loechel · 2025-10-18T14:18:00Z

Please do not unilaterally remove Python 3.9 support. This is done in concert with all other ZF packages.

@dataflake as RestrictedPython is one of the most underlying Package in Zope, that is where removal of Python Versions that are EOL needs to start.

I am not willing to add or accept Python 3.9 Support on RestrictedPython as soon as Pthon 3.14 Support is wanted.

We sould follow https://devguide.python.org/versions/ recommendations and remove Version support as soon as EOL is reached.
Users can still use older Versions of Restricted Python if they are on Python 3.9

dataflake · 2025-10-18T14:42:27Z

@dataflake as RestrictedPython is one of the most underlying Package in Zope, that is where removal of Python Versions that are EOL needs to start.

I disagree. We have always done it the other way around. Zope officially declares a Python version unsupported and after that its dependencies can drop it.

I am not willing to add or accept Python 3.9 Support on RestrictedPython as soon as Python 3.14 Support is wanted.

I appreciate your work but I really don't like the fact that you are forcing this issue without even asking anyone before. You do realize that e.g. the Plone 6.0 release series, which is in security support mode until the end of 2027, still uses Python 3.9?

If you had told me beforehand that you were making work on Python 3.14 dependent on dropping 3.9 we could have planned for that. Or I would have said thank you, I'll just do it myself then.

loechel · 2025-10-18T15:15:23Z

I have and will always do my best to preserve compatibility to base packages. Keeping 3.9 Support in unreasonable at the moment.

As the Plone Community is moving towards typing support for all Packages, this Pull Requests adds typing Annotation and Python 3.14 Support.

Yes we could have done that on seperate Pull requests, but rerssources are limited.
Modern Typing is only supported in Python 3.10 and higher.
Python 3.9-3.13 Support is given with The RestrictedPython Version Line 7.

And @dataflake saying that this was done with out asking anyone is untrue, I am at the Plone Conf sprint, where most of the underlying maintainace of Packages happen, and spoken and discussed it with relevant stakeholders.

And also let me say that, I am very unhappy with the maintainance of this package. Before me no-one in the community has taken care of this package, even if all of Zope and Plone was depending on this package. I have invested several years or work getting it into maintainable shape and into continious maintainance. Yes that would not be able without the help of @icemac . But I am actually pretty annoyed if people delete almost one third of the documentation and history, because they feel it is not needed anymore, as versions has been dropped.

Another example of this is that I invested a lot of work into make this package maintainable and understandable, with making the NodeTransformer as explicite as possible. And than someone thinks we can reduce the amount of unneccesary code by deleting and implicit calling of not_allowed.

loechel · 2025-10-18T15:15:59Z

I have added Python 3.9 to be allow with this Pull Request, but I will not solve the errors of that Version.

loechel · 2025-10-18T15:22:59Z

and for the Zope/Plone Support see https://plone.org/security/update-policy
Plone 6.0 may still support 3.9 but will never use any RestrictedPython 8 version, as that would go against the update-policy.

SO I do not see any reasoning for your argument in the first place.

Copilot

Pull Request Overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-18T15:49:56Z

src/RestrictedPython/transformer.py

+                 errors: list[str] | None = None,
+                 warnings: list[str] | None = None,
+                 used_names: dict[str,
+                                  str] | None = None):


The type annotation for used_names parameter is incorrect. Based on the context and usage patterns in the codebase, used_names should be dict[str, bool] not dict[str, str], as it maps variable names to boolean values indicating their usage.

Suggested change

str] | None = None):

bool] | None = None):

setup.py

Copilot · 2025-10-18T15:49:56Z

setup.py

      long_description=read('README.rst') + '\n' + read('CHANGES.rst'),
      long_description_content_type='text/x-rst',
      classifiers=[
          'Development Status :: 6 - Mature',


The 'License :: OSI Approved :: Zope Public License' classifier was removed but should be retained as it provides important licensing information for package consumers.

Suggested change

'Development Status :: 6 - Mature',

'Development Status :: 6 - Mature',

'License :: OSI Approved :: Zope Public License',

dataflake · 2025-10-18T16:07:24Z

As the Plone Community is moving towards typing support for all Packages, this Pull Requests adds typing Annotation and Python 3.14 Support.

Yes we could have done that on seperate Pull requests, but rerssources are limited. Modern Typing is only supported in Python 3.10 and higher. Python 3.9-3.13 Support is given with The RestrictedPython Version Line 7.

And @dataflake saying that this was done with out asking anyone is untrue, I am at the Plone Conf sprint, where most of the underlying maintainace of Packages happen, and spoken and discussed it with relevant stakeholders.

What I am reading is that you're not discussing with anyone involved in maintaining Zope itself or the Zope Foundation package ecosystem of nearly 300 packages. You're at the Plone conference and speaking to Plone package maintainers who provide you with input about their goals. I don't see any discussion to synchronize these goals with the Zope community, all I see is unilateral decisions and then a refusal to consider other standpoints.

And also let me say that, I am very unhappy with the maintainance of this package. Before me no-one in the community has taken care of this package, even if all of Zope and Plone was depending on this package. I have invested several years or work getting it into maintainable shape and into continious maintainance. Yes that would not be able without the help of @icemac . But I am actually pretty annoyed if people delete almost one third of the documentation and history, because they feel it is not needed anymore, as versions has been dropped.

Why did you not bring up these concerns when that happened and instead try to use it now as an example for how unnamed people other than you are bad at maintaining this package?

Another example of this is that I invested a lot of work into make this package maintainable and understandable, with making the NodeTransformer as explicite as possible. And than someone thinks we can reduce the amount of unneccesary code by deleting and implicit calling of not_allowed.

See above.

dataflake · 2025-10-19T14:36:15Z

I have now merged in master and removed Python 3.9 support again. Please take a look.

CHANGES.rst

Type Annotations for RestrictedPython

7876a87

loechel requested review from Copilot, davisagli, ericof and icemac October 18, 2025 08:32

loechel marked this pull request as draft October 18, 2025 08:33

Copilot AI reviewed Oct 18, 2025

View reviewed changes

loechel added 8 commits October 18, 2025 11:36

isinstance check with ExtSlice and Tuple as for older Python Versions

1cd6198

liniting

e2599ab

Remove Python 3.9 as it end of life

4915d8e

Remove License Cassifier, as they are deprecated

3299a8b

Add Comment for TryStar Annotation

4d56e39

Add Comment for TryStar Annotation

935a960

Add Comment for TryStar Annotation

e67da67

Add Changelog Entry

2a3d728

loechel requested a review from Copilot October 18, 2025 09:23

Copilot AI reviewed Oct 18, 2025

View reviewed changes

Base for Python 3.14 Updates

3373795

loechel and others added 5 commits October 18, 2025 13:49

Update docs for Python 3.14

f86d895

add provisional visit_TempalteStr and visit_Interpolation to transfor…

b4ceb35

…mer to start looking into it

Disable t-strings

43941ee

Apply pre-commit code formatting

f0e2a06

reactivate Template-Strings

26a218c

loechel and others added 2 commits October 18, 2025 17:38

Update Documentation for TemplateStr and Interploation

a4e189e

Apply pre-commit code formatting

fd0328a

loechel added 2 commits October 18, 2025 17:45

conditional import

aceca07

fix coverage numbers

3533c0f

readd Python 3.9 support

e750331

loechel requested a review from Copilot October 18, 2025 15:49

Copilot AI reviewed Oct 18, 2025

View reviewed changes

This was referenced Oct 19, 2025

Add Python 3.14 support #304

Merged

Deprecated licence classifier in setup.py #305

Closed

dataflake added 3 commits October 19, 2025 16:19

Merge branch 'master' into typing

44f9842

- updating package files with zope/meta and fixing tests

5b8285c

- fix last test

ac53335

icemac reviewed Oct 20, 2025

View reviewed changes

CHANGES.rst Outdated Show resolved Hide resolved

dataflake added 2 commits October 20, 2025 16:24

Merge branch 'master' into typing

6ecdf5a

- expand change log entry to be more clear.

0e1408c

		def reorder(s: Iterable, with_: Iterable \| None = None,
		without: Iterable \| None = None) -> Iterable:

	'Development Status :: 6 - Mature',
	'Development Status :: 6 - Mature',
	'License :: OSI Approved :: Zope Public License',

Type Annotations for RestrictedPython #303

Are you sure you want to change the base?

Type Annotations for RestrictedPython #303

Uh oh!

Conversation

loechel commented Oct 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

dataflake Oct 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

dataflake commented Oct 18, 2025

Uh oh!

loechel commented Oct 18, 2025

Uh oh!

dataflake commented Oct 18, 2025

Uh oh!

loechel commented Oct 18, 2025

Uh oh!

loechel commented Oct 18, 2025

Uh oh!

loechel commented Oct 18, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

dataflake commented Oct 18, 2025

Uh oh!

dataflake commented Oct 19, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

loechel commented Oct 18, 2025 •

edited

Loading