Expand to 19 verified Python pitfalls with fixes and runnable examples

Add 33 advanced pitfalls: asyncio, threading, interpreter internals, data systems

…me-20261030

docs: clarify Python pitfalls title and introduction

Join 7,032 unique OSV advisories with deps.dev dependency graphs for
the top 1,000 PyPI packages, PyPI yanked releases, OpenSSF Scorecard
and OSV malicious-package records.

- docs/dependency-risk.md: findings, tables, recommendations, method
  and limitations.
- analysis/: scripts that regenerate every number, plus a CSV snapshot
  (30 October 2026).
- README: Part III link.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- docs/security.md (53-59): path joins with absolute paths, tarfile
  extraction (CVE-2007-4559), credentials forwarded on redirect by
  urllib.request, regex backtracking, decompression bombs, unsafe
  deserialization, signing-key confusion. Each lists the CVEs it
  produced; 58 and 59 are documented without attack code.
- examples/53-57: runnable, self-checking demonstrations of the
  harmless-to-demonstrate cases, verified on 3.13 and 3.14.
- README: "How the complexity shows up in production" table mapping
  each mechanism to its pitfalls, PyPI advisory counts and real cases.
  #43 gains CVE-2012-1150 as its real-world case.
- docs/dependency-risk.md: restructured by mechanism (code you never
  chose, parsers on untrusted input, conveniences hiding protocol
  decisions, ambiguous parameters, the layer below Python), with
  measurement caveats moved to appendices.
- analysis/charts.py and docs/img: three charts in light and dark SVG,
  using a palette validated for color-vision deficiency.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- fetch_deps/fetch_yanked/fetch_scorecard: only reuse cache entries
  that hold data. Failed fetches were cached as {"error": ...} and
  skipped forever, contradicting the documented rerun-after-failure.
- fetch_yanked: treat any non-false `yanked` value, including an empty
  string, as yanked. Refetching all 1,000 indexes gives the same 331
  packages and 940 yanked releases.
- analyze.py: only count graphs for the current top 1,000, so a
  refreshed ranking in an old data directory can't inflate reach.
  report.py: same filter for yank totals and Scorecard lookups.

All published numbers reproduce unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fetch_scorecard read ["version"] from the dependency cache whenever the
file existed. After a failed graph fetch that file holds only an error,
so every run raised KeyError before any request and could never
recover. Fall back to the package's default version when the cache has
no usable version.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Show how hidden complexity becomes real-world bugs: security pitfalls, vulnerability data and charts

…nd linter guardrails

- New pitfalls & verified examples (#60–#73):
  - Fundamentals (README.md): #60 all([]) vacuous truth, #61 itertools.groupby
    unsorted runs & shared cursor, #62 chained comparisons with in/is/==,
    #63 match/case bare-name capture.
  - Concurrency (docs/concurrency.md): #64 async for early-break cleanup leaks
    (contextlib.aclosing), #65 asyncio.gather() orphaned sibling tasks,
    #66 subprocess.Popen.wait() pipe buffer deadlocks, #67 GIL dict compound-op
    & free-threaded assumptions.
  - Object model (docs/object-model.md): #68 built-in dict/list C fast-path
    method bypasses, #69 __slots__ lost in subclasses, #70 __len__ falsiness.
  - Interpreter (docs/interpreter.md): #71 deferred/stringified annotations vs
    runtime introspection.
  - Data systems (docs/data-systems.md): #72 urllib.parse.urljoin path/origin
    pitfalls, #73 Unicode normalization & .casefold() vs .lower().
- Improvements to existing entries & repo tooling:
  - Add benign stdlib runnable examples for #58 and #59 (73/73 coverage).
  - Highlight isinstance(True, int) JSON validation trap in #14.
  - Add set/dict un-findable NaN key growth to #44.
  - Link #53 safe_join TOCTOU discussion to filelock advisories & clarify
    CWE-22 counts in docs/security.md.
  - Add copy-paste Ruff/type-checker/runtime guardrail section to README.md.
  - Add free-threaded CPython 3.13t and 3.14t to .github/workflows/verify.yml.

…ample

…rails

Add 14 leaky-abstraction pitfalls (#60–#73), 100% example coverage, and linter guardrails