Create debug file atomically instead of using tempfile.mktemp

tempfile.mktemp is deprecated since Python 2.3: it only returns a name,
leaving a window where another process can create the file first. Use
NamedTemporaryFile(delete=False) so the file is created atomically with
the same prefix/suffix naming.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: berendkleinhaneveld

collagraph/sfc/__init__.py

@@ -101,8 +101,15 @@ def _write_debug_file(tree, path):  # pragma: no cover
 
         # Create a meaningful filename based on the source .cgx file
         source_name = Path(path).stem if path else "template"
-        debug_file = Path(tempfile.mktemp(prefix=f"cgx_{source_name}_", suffix=".py"))
-        debug_file.write_text(formatted, encoding="utf-8")
+        with tempfile.NamedTemporaryFile(
+            mode="w",
+            encoding="utf-8",
+            prefix=f"cgx_{source_name}_",
+            suffix=".py",
+            delete=False,
+        ) as fh:
+            fh.write(formatted)
+        debug_file = Path(fh.name)
         logger.debug("CGX debug file written to: %s", debug_file)
 
         try:

tests/test_sfc_debug.py

@@ -1,7 +1,10 @@
 """Tests for the CGX_DEBUG support code paths."""
 
+import tempfile
+
 import collagraph.sfc
-from collagraph.sfc.compiler import format_code
+from collagraph.sfc import _write_debug_file
+from collagraph.sfc.compiler import construct_ast, format_code
 
 SIMPLE_TEMPLATE = """
 <item />
@@ -42,3 +45,22 @@ def test_load_falls_back_when_debug_source_is_broken(monkeypatch, tmp_path):
 
     component, _ = collagraph.sfc.load_from_string(SIMPLE_TEMPLATE)
     assert component.__name__ == "Item"
+
+
+def test_write_debug_file_avoids_mktemp(monkeypatch):
+    # tempfile.mktemp is deprecated and racy (the file is created
+    # after the name is picked); the debug file should be created
+    # atomically instead.
+    def forbidden(*args, **kwargs):
+        raise AssertionError("tempfile.mktemp is deprecated and insecure")
+
+    monkeypatch.setattr(tempfile, "mktemp", forbidden)
+
+    tree, _ = construct_ast(path="example.cgx", template=SIMPLE_TEMPLATE)
+    debug_file, source = _write_debug_file(tree, "example.cgx")
+
+    assert debug_file is not None
+    assert debug_file.name.startswith("cgx_example_")
+    assert debug_file.suffix == ".py"
+    assert debug_file.read_text(encoding="utf-8") == source
+    debug_file.unlink()