[`pyflakes`] Avoid removing the `format` call when it would change behavior (`F523`) by adityasingh2400 · Pull Request #25320 · astral-sh/ruff

adityasingh2400 · 2026-05-22T12:45:45Z

Summary

When every positional argument is unused, F523 removes the entire .format(...) call. That changes behavior whenever the format string relies on the call:

Brace escapes: "{{".format("!") returns "{", but "{{" is two characters.
Named placeholders: "{x}".format("!") raises KeyError, but "{x}" quietly succeeds.

This detects these cases and avoids removing the entire format call. We also tried the "ideal" fix described on the issue of processing the string to handle escapes ourselves, but just preserving the call seemed like the better tradeoff in terms of complexity.

Test plan

New mdtests based on the examples from the issue

Closes #15557

astral-sh-bot · 2026-05-22T12:55:10Z

`ruff-ecosystem` results

Linter (stable)

✅ ecosystem check detected no linter changes.

Linter (preview)

✅ ecosystem check detected no linter changes.

ntBre

I think we should try to implement the ideal fix described in #15557 (comment) rather than just marking the fix unsafe and still breaking the code.

…as no remaining replacement fields When dropping every positional argument leaves a format string with only `{{` / `}}` brace escapes, the rewrite now removes the `.format(...)` call and reduces the escapes to single braces so the result matches what `.format()` would have produced. When the string still has replacement fields (auto, indexed, or named), the empty `.format()` call is kept so the runtime behaviour, including any `KeyError`, is preserved. Both branches are safe fixes again.

adityasingh2400 · 2026-05-22T20:20:22Z

Implemented the ideal fix in 0c706a0. When dropping the unused arguments leaves a format string with no replacement fields, the rule now removes the .format() call and reduces any {{ and }} escapes to single braces. When the string still has replacement fields, the empty .format() call is kept so the KeyError raised by an unset named placeholder is preserved. Both branches are safe fixes again. Added test cases covering "{{".format("!"), "{x}".format("!"), "{{}}".format("!"), "{{0}}".format("!"), and "{x}".format("!", x=1).

ntBre

Thanks for looking into this. After seeing the complexity introduced by the "ideal" fix, I think I'd actually prefer just to avoid removing the .format call if the string contains braces.

ntBre · 2026-05-27T19:23:42Z

+    if string_expr.value.is_implicit_concatenated() {
+        return None;
+    }


I think this will be bail out unnecessarily in a case like this:

("Hello" "world").format("!")

so I think we need to separate the string-processing safety from the number of arguments safety.

Thanks, that simpler approach is much nicer. I dropped the brace-rewriting helper entirely. Now I only remove the .format(...) call when the receiver string has no braces, where it is a genuine no-op, and whenever the string contains any { or } I keep the now-argumentless .format() call so the runtime behaviour, including any KeyError, is preserved. I also pulled the brace check out of the argument-count handling so they are independent, which means ("Hello" "world").format("!") no longer bails and just becomes "Hello" "world". And I removed the duplicated comments so the explanation only lives in the function docs now.

ntBre · 2026-05-27T19:31:51Z

+        // `.format()` would not have changed anything in the resulting
+        // string, so reuse the original source as-is.
+        return Some(locator.slice(string_expr).to_string());
+    }
+
+    let content_range = literal.content_range();
+    let source_content = locator.slice(content_range);
+
+    // The textual `{{` -> `{` rewrite below is only safe when the source
+    // content matches the decoded value: otherwise a Python escape sequence
+    // such as `\x7b` could combine with a neighbouring literal brace and
+    // change the resulting string.


I think these comments are already covered by the function docs. I actually kind of prefer them here I think, but we should delete them either here or in the function docs to avoid duplication.

Instead of rewriting brace escapes when dropping every positional argument, only drop the .format(...) call when the receiver string has no braces, where .format() is a genuine no-op. When the string contains any { or }, keep the now-argumentless .format() call so the runtime behaviour, including any KeyError, is preserved. The brace safety check is now separate from the argument-count handling, so an implicit-concatenated receiver such as ("Hello" "world").format("!") no longer bails the whole fix.

the additional summary fields are passed via brackets, so the simple `contains` check takes care of this too

ntBre

Thanks. I pushed a few commits converting the tests to use our new mdtest framework, trim down some of the commentary, and simplify out the summary argument again. This should be redundant with the new contains check on the braces since the only way to create those summary fields is by including braces in the format string. I also trimmed down the test suite to just the examples from the issue because the other cases also seemed straightforward now that there's no tricky brace manipulation going on.

Just waiting to see a clean ecosystem check after my changes, and then I'll merge!

codspeed-hq · 2026-05-29T19:03:25Z

Merging this PR will improve performance by 8.92%

⚠️

Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 5 improved benchmarks
✅ 55 untouched benchmarks
⏩ 65 skipped benchmarks¹

Performance Changes

	Mode	Benchmark	`BASE`	`HEAD`	Efficiency
⚡	Memory	`parser[numpy/globals.py]`	18 KB	16 KB	+12.28%
⚡	Memory	`parser[pydantic/types.py]`	403.2 KB	368.5 KB	+9.41%
⚡	Memory	`parser[large/dataset.py]`	862.2 KB	816.8 KB	+5.56%
⚡	Memory	`parser[unicode/pypinyin.py]`	55.5 KB	52.6 KB	+5.45%
⚡	Memory	`parser[numpy/ctypeslib.py]`	186.7 KB	166.5 KB	+12.13%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

_{Comparing adityasingh2400:fix-15557 (10746c6) with main (572e4b5)²}

65 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩
No successful run was found on main (1518f1d) during the generation of this report, so 572e4b5 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

astral-sh-bot Bot assigned ntBre May 22, 2026

astral-sh-bot Bot requested a review from ntBre May 22, 2026 12:45

ntBre requested changes May 22, 2026

View reviewed changes

adityasingh2400 force-pushed the fix-15557 branch from 99d4014 to 0c706a0 Compare May 22, 2026 20:20

ntBre reviewed May 27, 2026

View reviewed changes

adityasingh2400 and others added 6 commits May 29, 2026 04:42

add failing mdtests

02d8d79

Merge branch 'main' into fix-15557

ef17fd2

update mdtest results

131267e

simplify comments and remove unnecessary FormatSummary argument

62f2e10

the additional summary fields are passed via brackets, so the simple `contains` check takes care of this too

revert other test changes

10746c6

ntBre approved these changes May 29, 2026

View reviewed changes

ntBre added bug Something isn't working fixes Related to suggested fixes for violations labels May 29, 2026

ntBre changed the title ~~[pyflakes] Mark F523 fix as unsafe when it removes a meaningful .format(...) call~~ [pyflakes] Avoid removing the format call when it would change behavior (F523) May 29, 2026

ntBre merged commit 49882fa into astral-sh:main May 29, 2026
45 checks passed

ntBre mentioned this pull request May 29, 2026

[pyupgrade] Fix UP032 conversion soundness bugs (#15874) #25333

Closed

BrewTestBot mentioned this pull request Jun 4, 2026

ruff 0.15.16 Homebrew/homebrew-core#286308

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[`pyflakes`] Avoid removing the `format` call when it would change behavior (`F523`)#25320

[`pyflakes`] Avoid removing the `format` call when it would change behavior (`F523`)#25320
ntBre merged 7 commits into
astral-sh:mainfrom
adityasingh2400:fix-15557

adityasingh2400 commented May 22, 2026 •

edited by ntBre

Loading

Uh oh!

astral-sh-bot Bot commented May 22, 2026 •

edited

Loading

Uh oh!

ntBre left a comment

Uh oh!

adityasingh2400 commented May 22, 2026

Uh oh!

ntBre left a comment

Uh oh!

ntBre May 27, 2026

Uh oh!

adityasingh2400 May 29, 2026

Uh oh!

ntBre May 27, 2026

Uh oh!

ntBre left a comment

Uh oh!

codspeed-hq Bot commented May 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

adityasingh2400 commented May 22, 2026 • edited by ntBre Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

astral-sh-bot Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ruff-ecosystem results

Linter (stable)

Linter (preview)

Uh oh!

ntBre left a comment

Choose a reason for hiding this comment

Uh oh!

adityasingh2400 commented May 22, 2026

Uh oh!

ntBre left a comment

Choose a reason for hiding this comment

Uh oh!

ntBre May 27, 2026

Choose a reason for hiding this comment

Uh oh!

adityasingh2400 May 29, 2026

Choose a reason for hiding this comment

Uh oh!

ntBre May 27, 2026

Choose a reason for hiding this comment

Uh oh!

ntBre left a comment

Choose a reason for hiding this comment

Uh oh!

codspeed-hq Bot commented May 29, 2026

Merging this PR will improve performance by 8.92%

Performance Changes

Footnotes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

adityasingh2400 commented May 22, 2026 •

edited by ntBre

Loading

astral-sh-bot Bot commented May 22, 2026 •

edited

Loading

`ruff-ecosystem` results