From ae1cc275829d6b4d5b8bd7ed7a5f43b0337d4e5f Mon Sep 17 00:00:00 2001
From: Veit Heller <veit@veitheller.de>
Date: Sun, 6 Sep 2026 00:46:38 +0200
Subject: [PATCH] Follow core's rename of format to unsafe-format

---
 cli.carp      | 25 ++++++++++++++-----------
 test/cli.carp | 22 +++++++++++-----------
 2 files changed, 25 insertions(+), 22 deletions(-)

diff --git a/cli.carp b/cli.carp
index c9da173..fe938c3 100644
--- a/cli.carp
+++ b/cli.carp
@@ -52,21 +52,23 @@
         (Boolean p) (match @b (Boolean q) (= p q) _ false)))
     (implements = CLI.Type.=)
 
-    (defn format [s t]
+    ; `s` is caller-supplied and reaches C’s `printf` unchecked, so this
+    ; implementation carries the interface’s hazard in full.
+    (defn unsafe-format [s t]
       (match @t
-        (Integer i) (Long.format s i)
-        (Floating f) (Double.format s f)
-        (Str s2) (String.format s &s2)
-        (Boolean b) (String.format s (if b "true" "false"))
-        (None) (String.format s "none")))
-    (implements format CLI.Type.format)
+        (Integer i) (Long.unsafe-format s i)
+        (Floating f) (Double.unsafe-format s f)
+        (Str s2) (String.unsafe-format s &s2)
+        (Boolean b) (String.unsafe-format s (if b "true" "false"))
+        (None) (String.unsafe-format s "none")))
+    (implements unsafe-format CLI.Type.unsafe-format)
 
     ; qualified X.str calls conflict with the CLI.str macro in the VM-era
-    ; compiler, so these use format instead
+    ; compiler, so these use unsafe-format instead
     (defn str [t]
       (match @t
-        (Type.Integer i) (Long.format "%lld" i)
-        (Type.Floating f) (Double.format "%g" f)
+        (Type.Integer i) (Long.unsafe-format "%lld" i)
+        (Type.Floating f) (Double.unsafe-format "%g" f)
         (Type.Str s) s
         (Type.Boolean b) (if b @"true" @"false")
         (Type.None) @"none"))
@@ -360,7 +362,8 @@ Options:" (StaticArray.unsafe-nth &System.args 0) &(options-str p) (Parser.descr
           (match @(Option.default arg)
             (Maybe.Just default-val)
               (IO.print
-                &(fmt " (default: %s)" &(CLI.Type.format "%s" &default-val)))
+                &(fmt " (default: %s)"
+                      &(CLI.Type.unsafe-format "%s" &default-val)))
             (Maybe.Nothing) ())
           (match @(Option.options arg)
             (Maybe.Just o)
diff --git a/test/cli.carp b/test/cli.carp
index 4b82ef2..c297e2f 100644
--- a/test/cli.carp
+++ b/test/cli.carp
@@ -254,32 +254,32 @@
 
   (assert-equal test "none" &(CLI.Type.str &(CLI.Type.None)) "Type.str none")
 
-  ; --- Type.format ---
+  ; --- Type.unsafe-format ---
 
   (assert-equal test
     "42"
-    &(CLI.Type.format "%lld" &(CLI.Type.Integer 42l))
-    "Type.format integer")
+    &(CLI.Type.unsafe-format "%lld" &(CLI.Type.Integer 42l))
+    "Type.unsafe-format integer")
 
   (assert-equal test
     "3.140000"
-    &(CLI.Type.format "%f" &(CLI.Type.Floating 3.14))
-    "Type.format float")
+    &(CLI.Type.unsafe-format "%f" &(CLI.Type.Floating 3.14))
+    "Type.unsafe-format float")
 
   (assert-equal test
     "hello"
-    &(CLI.Type.format "%s" &(CLI.Type.Str @"hello"))
-    "Type.format string")
+    &(CLI.Type.unsafe-format "%s" &(CLI.Type.Str @"hello"))
+    "Type.unsafe-format string")
 
   (assert-equal test
     "true"
-    &(CLI.Type.format "%s" &(CLI.Type.Boolean true))
-    "Type.format boolean")
+    &(CLI.Type.unsafe-format "%s" &(CLI.Type.Boolean true))
+    "Type.unsafe-format boolean")
 
   (assert-equal test
     "none"
-    &(CLI.Type.format "%s" &(CLI.Type.None))
-    "Type.format none")
+    &(CLI.Type.unsafe-format "%s" &(CLI.Type.None))
+    "Type.unsafe-format none")
 
   ; --- Type.to-* conversions ---