Skip to content

no-injected-module-loader

Avoid a generic module-loader parameter used only to import one fixed module.

Why

When every direct use imports the same literal module, a generic importer can be unnecessary customization rather than a domain dependency. Dynamic plugin/import APIs legitimately need import hooks.

Fix

Consider owning the fixed import inside the implementation when import-hook substitution is unnecessary. Preserve intentional import hooks and plugin APIs; do not add wrapper factories or Protocols just to silence this advisory.

Examples

Before — flagged Import machinery becomes a configurable parameter
app/service.py
import importlib
def run(*, loader=importlib.import_module):
return loader("plugin").create()
After — preferred Implementation owns its lazy import
app/service.py
def run():
from plugin import create
return create()