From b6ae789b1fa7913cfdb7a342248ecee1297796c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Tue, 27 Oct 2026 19:29:47 -0700 Subject: [PATCH] =?UTF-8?q?=F0=9F=91=B7=20ci(codeql):=20add=20the=20contai?= =?UTF-8?q?nment=20query=20mutant?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #3481 merged after the liveness job from #3484, so the job found no patch for UncontainedMetadataDelete. The patch drops the root containment check that the query guards. Refs #3464 --- .../codeql/mutants/UncontainedMetadataDelete.patch | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 .github/codeql/mutants/UncontainedMetadataDelete.patch diff --git a/.github/codeql/mutants/UncontainedMetadataDelete.patch b/.github/codeql/mutants/UncontainedMetadataDelete.patch new file mode 100644 index 000000000..87ea3de62 --- /dev/null +++ b/.github/codeql/mutants/UncontainedMetadataDelete.patch @@ -0,0 +1,13 @@ +diff --git a/src/virtualenv/seed/embed/via_app_data/pip_install/base.py b/src/virtualenv/seed/embed/via_app_data/pip_install/base.py +index 2fd3ac26..5347c551 100644 +--- a/src/virtualenv/seed/embed/via_app_data/pip_install/base.py ++++ b/src/virtualenv/seed/embed/via_app_data/pip_install/base.py +@@ -215,7 +215,7 @@ class PipInstall(ABC): + linked: Final = entry.is_symlink() + # Unlinking the final link leaves its target intact; parent links still affect containment. + resolved: Final = entry.parent.resolve() / entry.name if linked else entry.resolve() +- if root not in resolved.parents or resolved in metadata_parents: ++ if resolved in metadata_parents: + LOGGER.warning( + "skip removal of %s listed by %s: not inside environment %s or a parent of the metadata", + entry,