…a systems

- docs/concurrency.md (20-30): asyncio task garbage collection,
  forgotten await, blocking the loop, swallowed cancellation,
  cross-thread loop calls, non-atomic +=, vanishing thread exceptions,
  Lock re-entry, threading.local under asyncio, fork() deadlocks,
  daemon threads.
- docs/object-model.md (31-37): property vs __getattr__, lru_cache
  leaks, __eq__ removing __hash__, __exit__ swallowing, weakrefs to
  bound methods, mock.patch targets, double-imported __main__.
- docs/interpreter.md (38-42): -O stripping asserts, class-body
  comprehension scope, locals() writes, id() reuse, int/str limit.
- docs/data-systems.md (43-52): hash() sharding, NaN, nanosecond
  timestamps, float prices, DST arithmetic, fixed UTC offsets,
  utcnow(), struct alignment, non-standard JSON.
- README: advanced contents table and an "In the wild" section on
  Home Assistant bug fixes and guard rails, each linked to the PR or
  source file. Examples 48 and 49 reproduce HA PRs #188537 and #188836.
- One self-checking example per pitfall; all 52 run in CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Expand to 19 verified Python pitfalls with fixes and runnable examples

- examples/24: disable inherited asyncio debug mode before the stall
  demo. Under PYTHONASYNCIODEBUG=1 or -X dev, call_soon from a thread
  raised in the worker and the example hung forever. Waits now have a
  5s timeout, so a regression fails instead of hanging.
- docs/concurrency.md #21: -W error::RuntimeWarning does not fail on a
  never-awaited coroutine, because the warning fires during
  finalization and becomes an unraisable exception. Document the pytest
  filters that do fail (verified with pytest 9.2).
- CI: also run every example under -X dev.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Add 33 advanced pitfalls: asyncio, threading, interpreter internals, data systems

…me-20261030

docs: clarify Python pitfalls title and introduction

Join 7,032 unique OSV advisories with deps.dev dependency graphs for
the top 1,000 PyPI packages, PyPI yanked releases, OpenSSF Scorecard
and OSV malicious-package records.

- docs/dependency-risk.md: findings, tables, recommendations, method
  and limitations.
- analysis/: scripts that regenerate every number, plus a CSV snapshot
  (30 October 2026).
- README: Part III link.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- docs/security.md (53-59): path joins with absolute paths, tarfile
  extraction (CVE-2007-4559), credentials forwarded on redirect by
  urllib.request, regex backtracking, decompression bombs, unsafe
  deserialization, signing-key confusion. Each lists the CVEs it
  produced; 58 and 59 are documented without attack code.
- examples/53-57: runnable, self-checking demonstrations of the
  harmless-to-demonstrate cases, verified on 3.13 and 3.14.
- README: "How the complexity shows up in production" table mapping
  each mechanism to its pitfalls, PyPI advisory counts and real cases.
  #43 gains CVE-2012-1150 as its real-world case.
- docs/dependency-risk.md: restructured by mechanism (code you never
  chose, parsers on untrusted input, conveniences hiding protocol
  decisions, ambiguous parameters, the layer below Python), with
  measurement caveats moved to appendices.
- analysis/charts.py and docs/img: three charts in light and dark SVG,
  using a palette validated for color-vision deficiency.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- fetch_deps/fetch_yanked/fetch_scorecard: only reuse cache entries
  that hold data. Failed fetches were cached as {"error": ...} and
  skipped forever, contradicting the documented rerun-after-failure.
- fetch_yanked: treat any non-false `yanked` value, including an empty
  string, as yanked. Refetching all 1,000 indexes gives the same 331
  packages and 940 yanked releases.
- analyze.py: only count graphs for the current top 1,000, so a
  refreshed ranking in an old data directory can't inflate reach.
  report.py: same filter for yank totals and Scorecard lookups.

All published numbers reproduce unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fetch_scorecard read ["version"] from the dependency cache whenever the
file existed. After a failed graph fetch that file holds only an error,
so every run raised KeyError before any request and could never
recover. Fall back to the package's default version when the cache has
no usable version.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Show how hidden complexity becomes real-world bugs: security pitfalls, vulnerability data and charts

…nd linter guardrails

- New pitfalls & verified examples (#60–#73):
  - Fundamentals (README.md): #60 all([]) vacuous truth, #61 itertools.groupby
    unsorted runs & shared cursor, #62 chained comparisons with in/is/==,
    #63 match/case bare-name capture.
  - Concurrency (docs/concurrency.md): #64 async for early-break cleanup leaks
    (contextlib.aclosing), #65 asyncio.gather() orphaned sibling tasks,
    #66 subprocess.Popen.wait() pipe buffer deadlocks, #67 GIL dict compound-op
    & free-threaded assumptions.
  - Object model (docs/object-model.md): #68 built-in dict/list C fast-path
    method bypasses, #69 __slots__ lost in subclasses, #70 __len__ falsiness.
  - Interpreter (docs/interpreter.md): #71 deferred/stringified annotations vs
    runtime introspection.
  - Data systems (docs/data-systems.md): #72 urllib.parse.urljoin path/origin
    pitfalls, #73 Unicode normalization & .casefold() vs .lower().
- Improvements to existing entries & repo tooling:
  - Add benign stdlib runnable examples for #58 and #59 (73/73 coverage).
  - Highlight isinstance(True, int) JSON validation trap in #14.
  - Add set/dict un-findable NaN key growth to #44.
  - Link #53 safe_join TOCTOU discussion to filelock advisories & clarify
    CWE-22 counts in docs/security.md.
  - Add copy-paste Ruff/type-checker/runtime guardrail section to README.md.
  - Add free-threaded CPython 3.13t and 3.14t to .github/workflows/verify.yml.

…ample

…rails

Add 14 leaky-abstraction pitfalls (#60–#73), 100% example coverage, and linter guardrails