fix: mass-ping leak, CDN link mangling, tz-naive timestamp, prompt limit drift

Fixes from the dpy4 audit report (REPORT_dpy4_audit.md, dpy_commons section):

- dpycommons-1 (HIGH): safe_send/_send applied kwargs to the first chunk only,
  so allowed_mentions/silent/suppress_embeds dropped off every chunk after
  the first, letting a suppressed @everyone/@here fire live on later chunks
  of a mass-ping. Mention-control kwargs now apply to every chunk; file/
  reference/view/etc. still ride the first message only.
- dpycommons-4 (MED): _DISCORD_HOST_RE missed discordapp.net (Discord's own
  media/image CDN), causing wrap_bare_links to <>-wrap preview links Discord
  itself emits; dropped the nonexistent discord.media host.
- dpycommons-8 (MED): discord_timestamp stamped naive datetimes as UTC,
  diverging from discord.py's own naive-datetime handling (local via
  astimezone()) and rendering the wrong wall time on non-UTC hosts. Now
  matches discord.py's behavior.
- dpycommons-9: prompts.py hardcoded the 5-button/80-char/100-char limits
  inline instead of sourcing from limits.py; moved them to limits.py
  (BUTTON_ROW_MAX, BUTTON_LABEL_MAX, SELECT_OPTION_LABEL_MAX,
  SELECT_PLACEHOLDER_MAX, SELECT_MAX_OPTIONS) and corrected the placeholder
  cap from 100 to Discord's actual 150; choose() now raises ValueError above
  25 options instead of failing inside discord.py's select builder.
- dpycommons-3: choose()'s select-label path now truncates labels to
  SELECT_OPTION_LABEL_MAX so a >80-char key routed to the select can no
  longer build a >100-char option label.
- dpycommons-7: safe_send's empty-input fallback now sends content=None
  instead of content='' (Discord rejects an explicit empty string).
- redundant except: dropped discord.NotFound from parsing.py's attachment
  read except tuple (it subclasses HTTPException, already caught).
- doc-only: softened chunk_text's "no content is lost" overclaim,
  documented extract_message_links as guild-only (DM @me links unmatched).

Version 0.1.0 -> 0.1.1.

Signed-off-by: disqualifier <dev@disqualifier.me>
This commit is contained in:
2026-07-03 15:33:21 -04:00
parent 056516dee9
commit f1f2ecf74a
8 changed files with 84 additions and 30 deletions
+1 -1
View File
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
[project]
name = "dpy_commons"
version = "0.1.0"
version = "0.1.1"
description = "Shared discord.py utilities — message/embed parsing, limit-fitting, link extraction, chunking, timestamps, await-prompts, limit-safe send. Config-free, installable."
requires-python = ">=3.10"
dependencies = [