Fix: NotAllowedResponse accepts an arbitrary unvalidated status_code despite being the 405 response

[pullapprove5]

Reproduced the finding: NotAllowedResponse(["GET"], status_code=200) succeeded and returned a response with status_code == 200, despite the class being documented as "HTTP 405 response" — the constructor's status_code parameter passed straight through to the base Response.__init__ with only the generic 200–599 range check, no constraint to 405. Fixed by following the exact precedent the finding pointed at (NotModifiedResponse): removed the status_code parameter from NotAllowedResponse.__init__ entirely, so the class always constructs with its status_code = 405 class default. Confirmed the sole caller (plain/views/base.py:130) never passed status_code, so no call site needed updating. Added a docstring note mirroring NotModifiedResponse's ("constructor is pinned") and a public test test_not_allowed_response_signature_is_pinned in plain/tests/public/test_http_bodiless_responses.py, asserting NotAllowedResponse(["GET"], status_code=200) now raises TypeError for the unexpected keyword argument. Ran ./scripts/fix plain (clean, no changes) and the full plain package test suite directly via uv run --isolated --package plain python -m pytest (698 passed, including the new test and all existing view-dispatch/405 tests) — the sandbox has no Docker/Postgres available, so I could not run ./scripts/test (it requires spinning up Postgres for the example project and other packages), but the change is confined to plain/plain/http/response.py and its own package's suite passed in full.

---

Opened by a PullApprove implementation run (implement-finding v4) for:

• PA-16 — NotAllowedResponse accepts an arbitrary unvalidated status_code despite being the 405 response

Merging this is what closes them as fixed.

[pullapprove5]

PENDING: 1 review scope pending, 1 agent approved

	Scope	Progress	Pending
⏳	code	0/1	davegaeddert

✅ codex approved

View in PullApprove

Next steps:

• pullapprove5[bot]: Waiting for reviews