Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Bump bandit from 1.7.5 to 1.7.8 (#8)
Bumps [bandit](https://github.com/PyCQA/bandit) from 1.7.5 to 1.7.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/PyCQA/bandit/releases">bandit's releases</a>.</em></p> <blockquote> <h2>1.7.8</h2> <h2>What's Changed</h2> <ul> <li>Incorrect tag naming in readme by <a href="https://github.com/lukehinds"><code>@lukehinds</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1105">PyCQA/bandit#1105</a></li> <li>Utilize PyPI's trusted publishing by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1107">PyCQA/bandit#1107</a></li> <li>Bump sigstore/cosign-installer from 3.3.0 to 3.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1109">PyCQA/bandit#1109</a></li> <li>Add 1.7.7 to versions of bug template by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1110">PyCQA/bandit#1110</a></li> <li>Use datetime to avoid updating copyright year by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1112">PyCQA/bandit#1112</a></li> <li>filter data is safe for tarfile extractall by <a href="https://github.com/etienneschalk"><code>@etienneschalk</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1111">PyCQA/bandit#1111</a></li> <li>Bump docker/setup-buildx-action from 3.0.0 to 3.1.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1115">PyCQA/bandit#1115</a></li> <li>[B605] Add functions that are vulnerable to shell injection. by <a href="https://github.com/shihai1991"><code>@shihai1991</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1116">PyCQA/bandit#1116</a></li> <li>Add a SARIF output formatter by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1113">PyCQA/bandit#1113</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/etienneschalk"><code>@etienneschalk</code></a> made their first contribution in <a href="https://redirect.github.com/PyCQA/bandit/pull/1111">PyCQA/bandit#1111</a></li> <li><a href="https://github.com/shihai1991"><code>@shihai1991</code></a> made their first contribution in <a href="https://redirect.github.com/PyCQA/bandit/pull/1116">PyCQA/bandit#1116</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PyCQA/bandit/compare/1.7.7...1.7.8">https://github.com/PyCQA/bandit/compare/1.7.7...1.7.8</a></p> <h2>1.7.7</h2> <h2>What's Changed</h2> <ul> <li>Add the new release to bandit versions of bug template by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1075">PyCQA/bandit#1075</a></li> <li>Bump actions/setup-python from 4 to 5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1076">PyCQA/bandit#1076</a></li> <li>Handle variant in how policy is passed in paramiko by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1078">PyCQA/bandit#1078</a></li> <li>Flag str.replace as possible sql injection by <a href="https://github.com/costaparas"><code>@costaparas</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1044">PyCQA/bandit#1044</a></li> <li>defusedxml: Show correct module name by <a href="https://github.com/kajinamit"><code>@kajinamit</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1081">PyCQA/bandit#1081</a></li> <li>Add tidelift to the sponsor funding list by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1089">PyCQA/bandit#1089</a></li> <li>Create a security policy by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1091">PyCQA/bandit#1091</a></li> <li>Fix up issues found running Bandit on itself by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1093">PyCQA/bandit#1093</a></li> <li>Add random.randbytes to blacklist calls by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1096">PyCQA/bandit#1096</a></li> <li>Prepend ./ for files specified as CLI args by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1094">PyCQA/bandit#1094</a></li> <li>Rework GitPython dependency to be an extra for bandit-baseline by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1099">PyCQA/bandit#1099</a></li> <li>Bump actions/dependency-review-action from 3 to 4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1101">PyCQA/bandit#1101</a></li> <li>Introduce Official Bandit Images by <a href="https://github.com/lukehinds"><code>@lukehinds</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1088">PyCQA/bandit#1088</a></li> <li>Remove markdown formatting in reStructuredText formatted README by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1103">PyCQA/bandit#1103</a></li> <li>Downsize the org:repo name by <a href="https://github.com/lukehinds"><code>@lukehinds</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1104">PyCQA/bandit#1104</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/kajinamit"><code>@kajinamit</code></a> made their first contribution in <a href="https://redirect.github.com/PyCQA/bandit/pull/1081">PyCQA/bandit#1081</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PyCQA/bandit/compare/1.7.6...1.7.7">https://github.com/PyCQA/bandit/compare/1.7.6...1.7.7</a></p> <h2>1.7.6</h2> <h2>What's Changed</h2> <ul> <li>Update bug report to include version 1.7.5 by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/993">PyCQA/bandit#993</a></li> <li>Render Python 3.10 in drop down correctly by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/997">PyCQA/bandit#997</a></li> <li>Remove checks for Python2 urllib by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/999">PyCQA/bandit#999</a></li> <li>Improper detection of non-requests module by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1011">PyCQA/bandit#1011</a></li> <li>xmlrpclib replaced with xmlrpc in Python3 by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1012">PyCQA/bandit#1012</a></li> <li>language and linting updates by <a href="https://github.com/marksmayo"><code>@marksmayo</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1015">PyCQA/bandit#1015</a></li> <li>Adds check for crypt module usage as weak hash by <a href="https://github.com/ericwb"><code>@ericwb</code></a> in <a href="https://redirect.github.com/PyCQA/bandit/pull/1018">PyCQA/bandit#1018</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/PyCQA/bandit/commit/22b4226078b041a16bf05163347a66ab4dbcf3a5"><code>22b4226</code></a> Add a SARIF output formatter (<a href="https://redirect.github.com/PyCQA/bandit/issues/1113">#1113</a>)</li> <li><a href="https://github.com/PyCQA/bandit/commit/b603dce79aefe794ce6a0531cb191a45f4e52e01"><code>b603dce</code></a> [B605] Add functions that are vulnerable to shell injection. (<a href="https://redirect.github.com/PyCQA/bandit/issues/1116">#1116</a>)</li> <li><a href="https://github.com/PyCQA/bandit/commit/a682a18af59ee7bccbeb8591637a31845be62c15"><code>a682a18</code></a> Bump docker/setup-buildx-action from 3.0.0 to 3.1.0 (<a href="https://redirect.github.com/PyCQA/bandit/issues/1115">#1115</a>)</li> <li><a href="https://github.com/PyCQA/bandit/commit/c8d5f77b35ffac67a04cf94d8279c6b5c833c667"><code>c8d5f77</code></a> filter data is safe for tarfile extractall (<a href="https://redirect.github.com/PyCQA/bandit/issues/1111">#1111</a>)</li> <li><a href="https://github.com/PyCQA/bandit/commit/e041e1216cf86f978614689fcf9e2d180db9c388"><code>e041e12</code></a> Use datetime to avoid updating copyright year (<a href="https://redirect.github.com/PyCQA/bandit/issues/1112">#1112</a>)</li> <li><a href="https://github.com/PyCQA/bandit/commit/5b16b6a832a7f1dbdb38f0c61ea2f882852d4594"><code>5b16b6a</code></a> Add 1.7.7 to versions of bug template (<a href="https://redirect.github.com/PyCQA/bandit/issues/1110">#1110</a>)</li> <li><a href="https://github.com/PyCQA/bandit/commit/858bfd882e25b6c936b56f71398f2dddb7cc95d2"><code>858bfd8</code></a> Bump sigstore/cosign-installer from 3.3.0 to 3.4.0 (<a href="https://redirect.github.com/PyCQA/bandit/issues/1109">#1109</a>)</li> <li><a href="https://github.com/PyCQA/bandit/commit/be5d6ace29e30bc21593f02a0466426cebdc24a2"><code>be5d6ac</code></a> Utilize PyPI's trusted publishing (<a href="https://redirect.github.com/PyCQA/bandit/issues/1107">#1107</a>)</li> <li><a href="https://github.com/PyCQA/bandit/commit/c3a07e5ee7d45b73dcac1843052dacb8a4fc6fc6"><code>c3a07e5</code></a> Incorrect tag naming in readme (<a href="https://redirect.github.com/PyCQA/bandit/issues/1105">#1105</a>)</li> <li><a href="https://github.com/PyCQA/bandit/commit/4c5b3c81e4356001b472849b05af902064d68515"><code>4c5b3c8</code></a> Downsize the org:repo name (<a href="https://redirect.github.com/PyCQA/bandit/issues/1104">#1104</a>)</li> <li>Additional commits viewable in <a href="https://github.com/PyCQA/bandit/compare/1.7.5...1.7.8">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
- Loading branch information
1 parent
22101df
commit 5a77b04