Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update: bump the pip-packages group across 1 directory with 5 updates #192

Closed
wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Apr 26, 2024

Bumps the pip-packages group with 5 updates in the / directory:

Package From To
semgrep 1.69.0 1.70.0
cheroot 10.0.0 10.0.1
mkdocs-material 9.5.18 9.5.19
black 24.4.0 24.4.2
pytest 8.1.1 8.1.2

Updates semgrep from 1.69.0 to 1.70.0

Release notes

Sourced from semgrep's releases.

Release v1.70.0

1.70.0 - 2024-04-24

Added

  • Added guidance for resolving API token issues in CI environments. (gh-10133)

  • The osemgrep show command supports 2 new options: dump-ast dump-pattern. See osemgrep show --help for more information. (osemgrep_show)

  • Added additional output flags which allow you to write output to multiple files in multiple formats.

    For example, the comand semgrep ci --text --json-output=result.json --sarif-output=result.sarif.json Displays text output on stdout, writes the output that would be generated by passing the --json flag to result.json, and writes the output that would be generated by passing the --sarif to result.sarif.json. (saf-341)

  • Added an experimental feature for users to use osemgrep to format SARIF output.

    When both the flags --sarif and --use-osemgrep-sarif are specified, semgrep will use the ocaml implementation to format SARIF.

    This flag is experimental and can be removed any time. Users must not rely on it being available. (saf-978)

Changed

  • The main regex engine is now PCRE2 (was PCRE). While the syntax is mostly compatible, there are some minor instances where updates to rules may be needed, since PCRE2 is slightly more strict in some cases. For example, while we previously accepted [\w-.], such a pattern would now need to be written [\w.-] or [\w\-.] since PCRE2 rejects the first as having an invalid range. (scrt-467)

Fixed

  • Semgrep LS now waits longer for users to login (gh-10109)

  • When semgrep ci finishes scanning and uploads findings, it tells the app to mark the scan as completed.

    For large findings, this may take a while and marking the scan as completed may timeout. When a scan is not marked as completed, the app may show that the repo is still processing, and confuses the user.

    This change increases the timeout (previously 20 minutes) to 30 minutes. (saf-980)

  • Fix semgrep ci --oss-only when secrets product is enabled. (scrt-223)

Changelog

Sourced from semgrep's changelog.

1.70.0 - 2024-04-24

Added

  • Added guidance for resolving API token issues in CI environments. (gh-10133)

  • The osemgrep show command supports 2 new options: dump-ast dump-pattern. See osemgrep show --help for more information. (osemgrep_show)

  • Added additional output flags which allow you to write output to multiple files in multiple formats.

    For example, the comand semgrep ci --text --json-output=result.json --sarif-output=result.sarif.json Displays text output on stdout, writes the output that would be generated by passing the --json flag to result.json, and writes the output that would be generated by passing the --sarif to result.sarif.json. (saf-341)

  • Added an experimental feature for users to use osemgrep to format SARIF output.

    When both the flags --sarif and --use-osemgrep-sarif are specified, semgrep will use the ocaml implementation to format SARIF.

    This flag is experimental and can be removed any time. Users must not rely on it being available. (saf-978)

Changed

  • The main regex engine is now PCRE2 (was PCRE). While the syntax is mostly compatible, there are some minor instances where updates to rules may be needed, since PCRE2 is slightly more strict in some cases. For example, while we previously accepted [\w-.], such a pattern would now need to be written [\w.-] or [\w\-.] since PCRE2 rejects the first as having an invalid range. (scrt-467)

Fixed

  • Semgrep LS now waits longer for users to login (gh-10109)

  • When semgrep ci finishes scanning and uploads findings, it tells the app to mark the scan as completed.

    For large findings, this may take a while and marking the scan as completed may timeout. When a scan is not marked as completed, the app may show that the repo is still processing, and confuses the user.

    This change increases the timeout (previously 20 minutes) to 30 minutes. (saf-980)

  • Fix semgrep ci --oss-only when secrets product is enabled. (scrt-223)

Commits
  • dee0ac1 chore: Bump version to 1.70.0
  • a3e8816 chore: use Logs src in Pcre2_.ml too (#10148)
  • fd333b0 Adding a new metric for the number of scanned diff targets in inter-file diff...
  • 27d05c2 fix: send notification when rules have refreshed (#10145)
  • 9fffebf ci: use pkg-config for all possible deps (#10141)
  • e5ba29c Add options to 'with_temp_file' (#10136)
  • 1b4d302 ci: ensure make exits with 2 when build fails (#10135)
  • 7663397 chore: be more verbose about rule downloading (#10134)
  • 5e10636 Update Testo, fixing temporary path masking bug (#10114)
  • ada467c Add suggestion for token setting in CI/non-interactive environments (#10133)
  • Additional commits viewable in compare view

Updates cheroot from 10.0.0 to 10.0.1

Changelog

Sourced from cheroot's changelog.

v10.0.1

(2024-04-22)

Bug fixes

  • Fixed a flaw where internally unhandled exceptions could crash the worker threads and eventually starve the server of its processing resources. It is no longer and issue and the unhandled errors are now logged and suppressed except for a few expected exceptions that are used for normal interruption requests.

    -- by :user:cameronbrunner and :user:webknjaz

    Related issues and pull requests on GitHub: :issue:310, :issue:346, :issue:354, :issue:358, :issue:365, :issue:375, :issue:599, :issue:641, :issue:649.

  • Fixed compatibility with Python 3.8 in the built-in TLS adapter that relies on :py:mod:python:ssl.

    Modern Python versions communicate specialized exceptions :py:exc:ssl.SSLEOFError and :py:exc:ssl.SSLZeroReturnError where the older versions errored out in a very generic way.

    -- by :user:toppk and :user:webknjaz

    Related issues and pull requests on GitHub: :issue:517, :issue:518.

Packaging updates and notes for downstreams

  • Started signing the package distribution artifacts in CI/CD with Sigstore and uploading them to GitHub Releases -- by :user:webknjaz.

    Related commits on GitHub: :commit:27a3c944, :commit:c45f184e.

  • The changelog management is now implemented through the :std:doc:Towncrier <towncrier:index> tool -- by :user:webknjaz.

    The contributors are now expected to :std:ref:`include

... (truncated)

Commits
  • 1391e71 Generate a change log entry for v10.0.1
  • c00f21b Revert "📝 Add a change note for PR #628"
  • 78a5e42 🧪 Make flaky tests on PyPy 3.6 + Ubuntu as xfail
  • 0da426b 📝🔥 Drop the Python 3.6 support drop change note
  • 7184939 🧪 Make Sphinx not fail on warnings
  • a9b77d3 🧪 Drop ubuntu 20.04 + pypy 3.6 from CI matrix
  • 935395b 🧪 Fix test compatibility with Python 3.6
  • 688fc83 Revert "Merge pull request #633 from cherrypy/debt/drop-py37"
  • 3591a1c 💅 Keep empty line separators next to YAML marks
  • 140f2cb 📝 Link the Towncrier docs via intersphinx
  • Additional commits viewable in compare view

Updates mkdocs-material from 9.5.18 to 9.5.19

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.5.19

  • Updated MkDocs to 1.6 and limited version to < 2
  • Updated Docker image to latest Alpine Linux
  • Removed setup.py, now that GitHub fully understands pyproject.toml
  • Improved interop of social plugin with third-party MkDocs themes
  • Fixed #7099: Blog reading time not rendered correctly for Japanese
  • Fixed #7097: Improved resilience of tags plugin when no tags are given
  • Fixed #7090: Active tab indicator in nested content tabs rendering bug
Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.5.19+insiders-4.53.8 (2024-04-26)

  • Fixed #7052: Preview extension automatically including all pages
  • Fixed #7051: Instant previews mounting on footnote references
  • Fixed #5165: Improved tooltips not mounting in sidebar for typeset plugin

mkdocs-material-9.5.19+insiders-4.53.7 (2024-04-25)

  • Fixed #7060: Incorrect resolution of translation when using static-i18n

mkdocs-material-9.5.19 (2024-04-25)

  • Updated MkDocs to 1.6 and limited version to < 2
  • Updated Docker image to latest Alpine Linux
  • Removed setup.py, now that GitHub fully understands pyproject.toml
  • Improved interop of social plugin with third-party MkDocs themes
  • Fixed #7099: Blog reading time not rendered correctly for Japanese
  • Fixed #7097: Improved resilience of tags plugin when no tags are given
  • Fixed #7090: Active tab indicator in nested content tabs rendering bug

mkdocs-material-9.5.18 (2024-04-16)

  • Refactored tooltips implementation to fix positioning issues
  • Fixed #7044: Rendering glitch when hovering contributor avatar in Chrome
  • Fixed #7043: Highlighted lines in code blocks cutoff on mobile
  • Fixed #6910: Incorrect position of tooltip for page status in sidebar
  • Fixed #6760: Incorrect position and overly long tooltip in tables
  • Fixed #6488: Incorrect position and cutoff tooltip in content tabs

mkdocs-material-9.5.17+insiders-4.53.6 (2024-04-05)

  • Ensure working directory is set for projects when using projects plugin
  • Fixed #6970: Incorrect relative paths in git submodules with projects plugin

mkdocs-material-9.5.17+insiders-4.53.5 (2024-04-02)

  • Fixed social plugin crashing when no colors are specified in palettes

mkdocs-material-9.5.17 (2024-04-02)

  • Updated Serbian translations
  • Fixed #7003: Confusing keyboard interaction for palette toggle
  • Fixed #7001: Blog posts now show time by default (9.5.16 regression)
  • Fixed edge case in backport of social plugin font loading logic

mkdocs-material-9.5.16+insiders-4.53.4 (2024-03-31)

  • Fixed #6973: Escaping issue in tags extra files deprecation helper

mkdocs-material-9.5.16 (2024-03-31)

... (truncated)

Commits
  • 0a39f04 Prepare 9.5.19 release
  • 023e177 Merge pull request #7082 from squidfunk/chore/update-to-mkdocs-1.6
  • 2585b82 Fixed all anchors after turning on validation
  • 0203408 Merge branch 'master' into chore/update-to-mkdocs-1.6
  • 2d07a6a Fixed rendering of tab indicator of nested content tabs
  • d98243d Merge branch 'master' into chore/update-to-mkdocs-1.6
  • 374bbab Updated dependencies
  • 254ee97 Updated distribution files
  • 04f177c Improved resilience of tags plugin (#7098)
  • bde889f Fixed Japanese translations
  • Additional commits viewable in compare view

Updates black from 24.4.0 to 24.4.2

Release notes

Sourced from black's releases.

24.4.2

This is a bugfix release to fix two regressions in the new f-string parser introduced in 24.4.1.

Parser

  • Fix regression where certain complex f-strings failed to parse (#4332)

Performance

  • Fix bad performance on certain complex string literals (#4331)

24.4.1

Highlights

  • Add support for the new Python 3.12 f-string syntax introduced by PEP 701 (#3822)

Stable style

  • Fix crash involving indented dummy functions containing newlines (#4318)

Parser

  • Add support for type parameter defaults, a new syntactic feature added to Python 3.13 by PEP 696 (#4327)

Integrations

  • Github Action now works even when git archive is skipped (#4313)
Changelog

Sourced from black's changelog.

24.4.2

This is a bugfix release to fix two regressions in the new f-string parser introduced in 24.4.1.

Parser

  • Fix regression where certain complex f-strings failed to parse (#4332)

Performance

  • Fix bad performance on certain complex string literals (#4331)

24.4.1

Highlights

  • Add support for the new Python 3.12 f-string syntax introduced by PEP 701 (#3822)

Stable style

  • Fix crash involving indented dummy functions containing newlines (#4318)

Parser

  • Add support for type parameter defaults, a new syntactic feature added to Python 3.13 by PEP 696 (#4327)

Integrations

  • Github Action now works even when git archive is skipped (#4313)
Commits

Updates pytest from 8.1.1 to 8.1.2

Release notes

Sourced from pytest's releases.

8.1.2

pytest 8.1.2 (2024-04-26)

Bug Fixes

  • #12114: Fixed error in pytest.approx{.interpreted-text role="func"} when used with [numpy]{.title-ref} arrays and comparing with other types.
Commits
  • cf84163 Prepare release version 8.1.2
  • 0675383 [8.1.x] Fixed Bug Regarding Attribute Error in pytest.approx For Types Implic...
  • a43b098 [8.1.x] Update events/trainings (#12237)
  • f55c660 [8.1.x] doc: import pytest in conftest.py example in doctest.rst (#12182)
  • be7c8be [8.1.x] Add research item in doc (#12148)
  • c5e3921 [8.1.x] doc: add versionadded to ExceptionInfo.group_contains (#12142)
  • 83614e1 [8.1.x] doc: fix typos (#12119)
  • cd585a1 [8.1.x] doc: add versionadded to Stash and StashKey (#12109)
  • 6c14139 [8.1.x] doc/flaky: remove box/flaky plugin suggestion (#12102)
  • abb0cf4 Merge pull request #12094 from pytest-dev/release-8.1.1
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the pip-packages group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [semgrep](https://github.com/returntocorp/semgrep) | `1.69.0` | `1.70.0` |
| [cheroot](https://github.com/cherrypy/cheroot) | `10.0.0` | `10.0.1` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.5.18` | `9.5.19` |
| [black](https://github.com/psf/black) | `24.4.0` | `24.4.2` |
| [pytest](https://github.com/pytest-dev/pytest) | `8.1.1` | `8.1.2` |



Updates `semgrep` from 1.69.0 to 1.70.0
- [Release notes](https://github.com/returntocorp/semgrep/releases)
- [Changelog](https://github.com/semgrep/semgrep/blob/develop/CHANGELOG.md)
- [Commits](semgrep/semgrep@v1.69.0...v1.70.0)

Updates `cheroot` from 10.0.0 to 10.0.1
- [Release notes](https://github.com/cherrypy/cheroot/releases)
- [Changelog](https://github.com/cherrypy/cheroot/blob/main/CHANGES.rst)
- [Commits](cherrypy/cheroot@v10.0.0...v10.0.1)

Updates `mkdocs-material` from 9.5.18 to 9.5.19
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.5.18...9.5.19)

Updates `black` from 24.4.0 to 24.4.2
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@24.4.0...24.4.2)

Updates `pytest` from 8.1.1 to 8.1.2
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@8.1.1...8.1.2)

---
updated-dependencies:
- dependency-name: semgrep
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-packages
- dependency-name: cheroot
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-packages
- dependency-name: mkdocs-material
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-packages
- dependency-name: black
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-packages
- dependency-name: pytest
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-packages
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Apr 26, 2024
Copy link

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA fd5a329.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
pip/black 24.4.2 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 8Found 23/27 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing🟢 10project is fuzzed
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/cheroot 10.0.1 🟢 5.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 1/23 approved changesets -- score normalized to 0
License🟢 10license file detected
CII-Best-Practices⚠️ 2badge detected: InProgress
Signed-Releases🟢 64 out of the last 5 releases have a total of 4 signed artifacts.
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/mkdocs 1.6.0 🟢 5.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 6Found 13/21 approved changesets -- score normalized to 6
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/mkdocs-get-deps 0.2.0 UnknownUnknown
pip/mkdocs-material 9.5.19 🟢 5.4
Details
CheckScoreReason
Code-Review⚠️ 2Found 7/26 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 25 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/pytest 8.1.2 🟢 6.4
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/semgrep 1.70.0 UnknownUnknown
pip/black 24.4.0 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 8Found 23/27 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing🟢 10project is fuzzed
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/cheroot 10.0.0 🟢 5.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 1/23 approved changesets -- score normalized to 0
License🟢 10license file detected
CII-Best-Practices⚠️ 2badge detected: InProgress
Signed-Releases🟢 64 out of the last 5 releases have a total of 4 signed artifacts.
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/mkdocs 1.5.3 🟢 5.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 6Found 13/21 approved changesets -- score normalized to 6
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/mkdocs-material 9.5.18 🟢 5.4
Details
CheckScoreReason
Code-Review⚠️ 2Found 7/26 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 25 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/pytest 8.1.1 🟢 6.4
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/semgrep 1.69.0 UnknownUnknown
pip/cheroot 10.0.1 🟢 5.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 1/23 approved changesets -- score normalized to 0
License🟢 10license file detected
CII-Best-Practices⚠️ 2badge detected: InProgress
Signed-Releases🟢 64 out of the last 5 releases have a total of 4 signed artifacts.
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/semgrep 1.70.0 UnknownUnknown
pip/cheroot 10.0.0 🟢 5.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 1/23 approved changesets -- score normalized to 0
License🟢 10license file detected
CII-Best-Practices⚠️ 2badge detected: InProgress
Signed-Releases🟢 64 out of the last 5 releases have a total of 4 signed artifacts.
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/semgrep 1.69.0 UnknownUnknown

Scanned Manifest Files

poetry.lock
pyproject.toml

Copy link

Coverage

Coverage Report
FileStmtsMissCoverMissing
semgr8s
   __main__.py16160%5–29
   app.py78396%116, 175–176
   k8s_api.py22291%43–44
   updater.py29293%49–50
TOTAL1972388% 

Tests Skipped Failures Errors Time
18 0 💤 0 ❌ 0 🔥 1.998s ⏱️

Copy link
Contributor Author

dependabot bot commented on behalf of github Apr 29, 2024

Superseded by #193.

@dependabot dependabot bot closed this Apr 29, 2024
@dependabot dependabot bot deleted the dependabot/pip/dev/pip-packages-3a7455e13d branch April 29, 2024 21:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants