[flake8-bandit] Fix truthiness: dict-only ** displays not truthy for shell (S602, S604, S609)

[danparizher]

Summary

Fixes #19927

[github-actions]

ruff-ecosystem results

Linter (stable)

✅ ecosystem check detected no linter changes.

Linter (preview)

✅ ecosystem check detected no linter changes.

Formatter (stable)

✅ ecosystem check detected no format changes.

Formatter (preview)

✅ ecosystem check detected no format changes.

[dscorbett]

With this change, {**{}} is considered falsey; what about {**{**{}}}?

[danparizher]

With this change, {**{}} is considered falsey; what about {**{**{}}}?

Good call, I had nested dict displays as truthy. I just pushed a change to have them checked recursively.

[ntBre]

Thanks for diving deep here, but I think I'd kind of lean towards just considering any starred mapping to be of unknown truthiness (so just removing the Expr::Name requirement from matches!). I don't think nested, unpacked, empty dict literals are very common, so it seems like a nicer trade-off between implementation complexity and accuracy. That's also what we do for lists, sets, and tuples just above this. Expr::is_starred_expr for those elements is analogous to matches!(item, DictItem { key: None, ... }) for dicts.

[ntBre]

It might also be nice to add a test case for a more common version of this problem like {**self.shell_defaults, **self.fetch_shell_config(self.username)} mentioned here. But the code fix should be the same anyway.

[danparizher]

The CI failures seem to be unrelated to my changes, wondering if the one for cargo fuzz build was introduced elsewhere

[ntBre]

Yeah no worries about the fuzz build. There was a breaking libcst release that we need to handle.

[ntBre]

Thank you! I'll probably close and reopen to re-trigger CI, but this looks ready to go once it passes.