Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update: bump the pip-packages group across 1 directory with 8 updates #380

Closed
wants to merge 1 commit into from
Closed

update: bump the pip-packages group across 1 directory with 8 updates #380

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Sep 26, 2024 •
edited
Loading

Bumps the pip-packages group with 8 updates in the / directory:

Package From To
pyyaml 6.0.1 6.0.2
semgrep 1.81.0 1.90.0
mkdocs-material 9.5.30 9.5.38
mike 2.1.2 2.1.3
bandit 1.7.9 1.7.10
black 24.4.2 24.8.0
pylint 3.2.6 3.3.1
pytest 8.3.2 8.3.3

Updates pyyaml from 6.0.1 to 6.0.2

Release notes

Sourced from pyyaml's releases.

6.0.2

What's Changed

  • Support for Cython 3.x and Python 3.13.

Full Changelog: yaml/pyyaml@6.0.1...6.0.2

6.0.2rc1

  • Support for extension build with Cython 3.x
  • Support for Python 3.13
  • Added PyPI wheels for musllinux on aarch64
Changelog

Sourced from pyyaml's changelog.

6.0.2 (2024-08-06)

Commits

Updates semgrep from 1.81.0 to 1.90.0

Release notes

Sourced from semgrep's releases.

Release v1.90.0

1.90.0 - 2024-09-25

Added

  • Expanded support for requirement lockfiles. Semgrep will now find any *requirement*.txt file and lockfiles in a requirements folder (**/requirements/*.txt). This functionality will be gated behind the --enable-experimental-requirements CLI flag. (sc-1752)

Changed

  • Security update for code snippet storage & access methods. (gh-2038)

Fixed

  • Errors that occur in semgrep scans with jobs > 1 will now have more detail (SAF-1628)
  • Dockerfile matching: CMD $...ARGS now behaves like CMD ... and matches any CMD instruction that uses the array syntax such as CMD ["ls"]. This fix also applies to the other command-like instructions RUN and ENTRYPOINT. (gh-9726)
  • Pro Engine: There is now improved type inference in Kotlin and Scala. Constructor invocations like Foo() will now be inferred properly to be of type Foo. (saf-1537)

Release v1.89.0

1.89.0 - 2024-09-19

Fixed

  • Fix crash on certain SCA parse errors caused by an access to an unbound variable. (gh-2259)

Release v1.88.0

1.88.0 - 2024-09-18

Added

  • The dataflow analysis in the Pro engine can now track method invocations on variables of an interface type, safely assuming that any implementation of the method can be called. For example, tainted input vulnerabilities in both implementation classes can now be detected in the following code:

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.90.0 - 2024-09-25

Added

  • Expanded support for requirement lockfiles. Semgrep will now find any *requirement*.txt file and lockfiles in a requirements folder (**/requirements/*.txt). This functionality will be gated behind the --enable-experimental-requirements CLI flag. (sc-1752)

Changed

  • Security update for code snippet storage & access methods. (gh-2038)

Fixed

  • Errors that occur in semgrep scans with jobs > 1 will now have more detail (SAF-1628)
  • Dockerfile matching: CMD $...ARGS now behaves like CMD ... and matches any CMD instruction that uses the array syntax such as CMD ["ls"]. This fix also applies to the other command-like instructions RUN and ENTRYPOINT. (gh-9726)
  • Pro Engine: There is now improved type inference in Kotlin and Scala. Constructor invocations like Foo() will now be inferred properly to be of type Foo. (saf-1537)

1.89.0 - 2024-09-19

Fixed

  • Fix crash on certain SCA parse errors caused by an access to an unbound variable. (gh-2259)

1.88.0 - 2024-09-18

Added

  • The dataflow analysis in the Pro engine can now track method invocations on variables of an interface type, safely assuming that any implementation of the method can be called. For example, tainted input vulnerabilities in both implementation classes can now be detected in the following code:

    

    • 






... (truncated)





Commits

    

  • 8d38a7f chore: release version 1.90.0
    • 

  • cf7d468semgrep/semgrep-proprietary#2332
    • 

  • 968f09d fix: wrap parmap in a result to avoid unmarshal errors (semgrep/semgrep-propr...
    • 

  • 01238e7semgrep/semgrep-proprietary#2328
    • 

  • 1c343e4semgrep/semgrep-proprietary#2329
    • 

  • 8ad3226 feat(sca): support different requirement lockfile patterns (semgrep/semgrep-p...
    • 

  • 89d04cbsemgrep/semgrep-proprietary#2326
    • 

  • 57e0172semgrep/semgrep-proprietary#2325
    • 

  • f2439a9 refactor: split out Parse_target.just_resolve_name (semgrep/semgrep-proprie...
    • 

  • e596f43 [dockerfile] Fix named ellipsis matching on CMD-like instructions using the a...
    • 

  • Additional commits viewable in compare view
    • 







Updates mkdocs-material from 9.5.30 to 9.5.38



Release notes

Sourced from mkdocs-material's releases.




mkdocs-material-9.5.38


    

  • Added Albanian translations
    • 



Thanks go to @​gerardkraja for their contributions


mkdocs-material-9.5.37


    

  • Added 4th and 5th level ordered list styles
    • 

  • Fixed #7548: Tags have no spacing in search
    • 



mkdocs-material-9.5.36


    

  • Fixed #7544: Social cards incorrectly rendering HTML entities
    • 

  • Fixed #7542: Improved support for setting custom list styles
    • 



mkdocs-material-9.5.35


    

  • Fixed #7498: Search not showing for Vietnamese language
    • 



mkdocs-material-9.5.34


    

  • Updated Mermaid.js to version 11 (latest)
    • 



Thanks go to @​manselmi for their contributions


mkdocs-material-9.5.33


    

  • Fixed #7453: Incorrect position of tooltip when sorting table
    • 



mkdocs-material-9.5.32


    

  • Fixed RXSS vulnerability via deep link in search results
    • 

  • Added support for fetching latest release from GitLab
    • 



Thanks go to @​joaopalmeiro for their contributions


mkdocs-material-9.5.31


    

  • Fixed #7405: DockerHub missing images > 9.5.27 due to change in Alpine/APK
    • 








Changelog

Sourced from mkdocs-material's changelog.




mkdocs-material-9.5.38 (2024-09-26)


    

  • Added Albanian translations
    • 



mkdocs-material-9.5.37 (2024-09-25)


    

  • Added 4th and 5th level ordered list styles
    • 

  • Fixed #7548: Tags have no spacing in search
    • 



mkdocs-material-9.5.36 (2024-09-21)


    

  • Fixed #7544: Social cards incorrectly rendering HTML entities
    • 

  • Fixed #7542: Improved support for setting custom list styles
    • 



mkdocs-material-9.5.35 (2024-09-18)


    

  • Fixed #7498: Search not showing for Vietnamese language
    • 



mkdocs-material-9.5.34+insiders-4.53.13 (2024-09-14)


    

  • Fixed #7520: Social plugin errors for generated files (MkDocs 1.6+)
    • 



mkdocs-material-9.5.34 (2024-08-31)


    

  • Updated Mermaid.js to version 11 (latest)
    • 



mkdocs-material-9.5.33 (2024-08-23)


    

  • Fixed #7453: Incorrect position of tooltip when sorting table
    • 



mkdocs-material-9.5.32 (2024-08-19)


    

  • Fixed RXSS vulnerability via deep link in search results
    • 

  • Added support for fetching latest release from GitLab
    • 



mkdocs-material-9.5.31+insiders-4.53.12 (2024-08-02)


    

  • Fixed #7410: Instant previews jump on content tabs with anchor links
    • 

  • Fixed #7408: Instant previews jump on content tabs
    • 



mkdocs-material-9.5.31 (2024-08-02)


    

  • Fixed #7405: DockerHub missing images > 9.5.27 due to change in Alpine/APK
    • 



mkdocs-material-9.5.30 (2024-07-23)


    

  • Fixed #7380: Navigation icons disappearing on hover in Safari
    • 

  • Fixed #7367: Blog readtime computation includes SVG text content
    • 



mkdocs-material-9.5.29 (2024-07-14)





... (truncated)





Commits






Updates mike from 2.1.2 to 2.1.3



Release notes

Sourced from mike's releases.




v2.1.3


Bug fixes


    

  • When deploying using a deploy prefix, only delete stale versions of the docs within that prefix
    • 








Changelog

Sourced from mike's changelog.




v2.1.3 (2024-08-12)


Bug fixes


    

  • When deploying using a deploy prefix, only delete stale versions of the docs
within that prefix
    • 










Commits

    

  • c4e9608 Update version to 2.1.3
    • 

  • 3b19e27 Announce the previous change
    • 

  • dd9826a Consult deploy prefix when deleting files during deploy; resolves #227
    • 

  • 91cf5ee Properly escape parameters in regex
    • 

  • 90cf131 Update version to 2.2.0.dev0
    • 

  • See full diff in compare view
    • 







Updates bandit from 1.7.9 to 1.7.10



Release notes

Sourced from bandit's releases.




1.7.10


What's Changed



New Contributors



Full Changelog: PyCQA/bandit@1.7.9...1.7.10







Commits

    

  • 36fd650 Pytorch Load / Save Plugin (#1114)
    • 

  • 4ac55df Use consistent file naming of docs (#1170)
    • 

  • 68022aa Bump docker/build-push-action from 6.6.1 to 6.7.0 (#1168)
    • 

  • 77566a0 Bump sigstore/cosign-installer from 3.5.0 to 3.6.0 (#1165)
    • 

  • 221ced6 Bump docker/build-push-action from 6.5.0 to 6.6.1 (#1166)
    • 

  • 701b7d5 Bump docker/setup-buildx-action from 3.5.0 to 3.6.1 (#1163)
    • 

  • 320495c Bump docker/build-push-action from 6.3.0 to 6.5.0 (#1160)
    • 

  • 90490c7 Bump docker/login-action from 3.2.0 to 3.3.0 (#1159)
    • 

  • 708ab74 Bump docker/setup-buildx-action from 3.4.0 to 3.5.0 (#1158)
    • 

  • 89d2345 Bump docker/setup-buildx-action from 3.3.0 to 3.4.0 (#1156)
    • 

  • Additional commits viewable in compare view
    • 







Updates black from 24.4.2 to 24.8.0



Release notes

Sourced from black's releases.




24.8.0


Stable style


    

  • Fix crash when # fmt: off is used before a closing parenthesis or bracket. (#4363)
    • 



Packaging


    

  • Packaging metadata updated: docs are explictly linked, the issue tracker is now also
linked. This improves the PyPI listing for Black. (#4345)
    • 



Parser


    

  • Fix regression where Black failed to parse a multiline f-string containing another
multiline string (#4339)
    • 

  • Fix regression where Black failed to parse an escaped single quote inside an f-string
(#4401)
    • 

  • Fix bug with Black incorrectly parsing empty lines with a backslash (#4343)
    • 

  • Fix bugs with Black's tokenizer not handling \{ inside f-strings very well (#4422)
    • 

  • Fix incorrect line numbers in the tokenizer for certain tokens within f-strings
(#4423)
    • 



Performance


    

  • Improve performance when a large directory is listed in .gitignore (#4415)
    • 



Blackd


    

  • Fix blackd (and all extras installs) for docker container (#4357)
    • 








Changelog

Sourced from black's changelog.




24.8.0


Stable style


    

  • Fix crash when # fmt: off is used before a closing parenthesis or bracket. (#4363)
    • 



Packaging


    

  • Packaging metadata updated: docs are explictly linked, the issue tracker is now also
linked. This improves the PyPI listing for Black. (#4345)
    • 



Parser


    

  • Fix regression where Black failed to parse a multiline f-string containing another
multiline string (#4339)
    • 

  • Fix regression where Black failed to parse an escaped single quote inside an f-string
(#4401)
    • 

  • Fix bug with Black incorrectly parsing empty lines with a backslash (#4343)
    • 

  • Fix bugs with Black's tokenizer not handling \{ inside f-strings very well (#4422)
    • 

  • Fix incorrect line numbers in the tokenizer for certain tokens within f-strings
(#4423)
    • 



Performance


    

  • Improve performance when a large directory is listed in .gitignore (#4415)
    • 



Blackd


    

  • Fix blackd (and all extras installs) for docker container (#4357)
    • 








Commits

    

  • b965c2a Prepare release 24.8.0 (#4426)
    • 

  • 9ccf279 Document find_project_root ignoring pyproject.toml without [tool.black]...
    • 

  • 14b6e61 fix: Enhace black efficiently to  skip directories listed in .gitignore (#4415)
    • 

  • b1c4dd9 fix: respect braces better in f-string parsing (#4422)
    • 

  • 4b4ae43 Fix incorrect linenos on fstring tokens with escaped newlines (#4423)
    • 

  • 7fa1faf docs: fix the installation command of extra for blackd (#4413)
    • 

  • 8827acc Bump sphinx from 7.3.7 to 7.4.0 in /docs (#4404)
    • 

  • b0da11d Bump furo from 2024.5.6 to 2024.7.18 in /docs (#4409)
    • 

  • 721dff5 fix: avoid formatting backslash strings inside f-strings (#4401)
    • 

  • 7e2afc9 Update actions/checkout to v4 to stop node deprecation warnings (#4379)
    • 

  • Additional commits viewable in compare view
    • 







Updates pylint from 3.2.6 to 3.3.1



Commits






Updates pytest from 8.3.2 to 8.3.3



Release notes

Sourced from pytest's releases.




8.3.3


pytest 8.3.3 (2024-09-09)


Bug fixes


    

  • 

    #12446: Avoid calling @property (and other instance descriptors) during fixture discovery -- by asottile{.interpreted-text role="user"}
    

    • 

  • 

    #12659: Fixed the issue of not displaying assertion failure differences when using the parameter --import-mode=importlib in pytest>=8.1.
    

    • 

  • 

    #12667: Fixed a regression where type change in [ExceptionInfo.errisinstance]{.title-ref} caused [mypy]{.title-ref} to fail.
    

    • 

  • 

    #12744: Fixed typing compatibility with Python 3.9 or less -- replaced [typing.Self]{.title-ref} with [typing_extensions.Self]{.title-ref} -- by Avasam{.interpreted-text role="user"}
    

    • 

  • 

    #12745: Fixed an issue with backslashes being incorrectly converted in nodeid paths on Windows, ensuring consistent path handling across environments.
    

    • 

  • 

    #6682: Fixed bug where the verbosity levels where not being respected when printing the "msg" part of failed assertion (as in assert condition, msg).
    

    • 

  • 

    #9422: Fix bug where disabling the terminal plugin via -p no:terminal would cause crashes related to missing the verbose option.
    

    -- by GTowers1{.interpreted-text role="user"}
    

    • 



Improved documentation


    

  • #12663: Clarify that the [pytest_deselected]{.title-ref} hook should be called from [pytest_collection_modifyitems]{.title-ref} hook implementations when items are deselected.
    • 

  • #12678: Remove erroneous quotes from [tmp_path_retention_policy]{.title-ref} example in docs.
    • 



Miscellaneous internal changes


    

  • #12769: Fix typos discovered by codespell and add codespell to pre-commit hooks.
    • 








Commits






Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.





Dependabot commands and options



You can trigger Dependabot actions by commenting on this PR:


    

  • @dependabot rebase will rebase this PR
    • 

  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • 

  • @dependabot merge will merge this PR after your CI passes on it
    • 

  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
    • 

  • @dependabot cancel merge will cancel a previously requested merge and block automerging
    • 

  • @dependabot reopen will reopen this PR if it is closed
    • 

  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
    • 

  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • 

  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
    • 

  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
    • 

  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    • 




    

  
  



      


          

          
  

    
  
    
    

  

  




          

        
      




  





                  



      

  
        

  

      

  
  

  
          

  

    

      


  

      
        @dependabot
  




      

        
          update: bump the pip-packages group across 1 directory with 8 updates
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          49e6963
        
      

    

  

    

      
Bumps the pip-packages group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pyyaml](https://github.com/yaml/pyyaml) | `6.0.1` | `6.0.2` |
| [semgrep](https://github.com/returntocorp/semgrep) | `1.81.0` | `1.90.0` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.5.30` | `9.5.38` |
| [mike](https://github.com/jimporter/mike) | `2.1.2` | `2.1.3` |
| [bandit](https://github.com/PyCQA/bandit) | `1.7.9` | `1.7.10` |
| [black](https://github.com/psf/black) | `24.4.2` | `24.8.0` |
| [pylint](https://github.com/pylint-dev/pylint) | `3.2.6` | `3.3.1` |
| [pytest](https://github.com/pytest-dev/pytest) | `8.3.2` | `8.3.3` |



Updates `pyyaml` from 6.0.1 to 6.0.2
- [Release notes](https://github.com/yaml/pyyaml/releases)
- [Changelog](https://github.com/yaml/pyyaml/blob/main/CHANGES)
- [Commits](yaml/pyyaml@6.0.1...6.0.2)

Updates `semgrep` from 1.81.0 to 1.90.0
- [Release notes](https://github.com/returntocorp/semgrep/releases)
- [Changelog](https://github.com/semgrep/semgrep/blob/develop/CHANGELOG.md)
- [Commits](semgrep/semgrep@v1.81.0...v1.90.0)

Updates `mkdocs-material` from 9.5.30 to 9.5.38
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.5.30...9.5.38)

Updates `mike` from 2.1.2 to 2.1.3
- [Release notes](https://github.com/jimporter/mike/releases)
- [Changelog](https://github.com/jimporter/mike/blob/master/CHANGES.md)
- [Commits](jimporter/mike@v2.1.2...v2.1.3)

Updates `bandit` from 1.7.9 to 1.7.10
- [Release notes](https://github.com/PyCQA/bandit/releases)
- [Commits](PyCQA/bandit@1.7.9...1.7.10)

Updates `black` from 24.4.2 to 24.8.0
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@24.4.2...24.8.0)

Updates `pylint` from 3.2.6 to 3.3.1
- [Release notes](https://github.com/pylint-dev/pylint/releases)
- [Commits](pylint-dev/pylint@v3.2.6...v3.3.1)

Updates `pytest` from 8.3.2 to 8.3.3
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@8.3.2...8.3.3)

---
updated-dependencies:
- dependency-name: pyyaml
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-packages
- dependency-name: semgrep
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-packages
- dependency-name: mkdocs-material
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-packages
- dependency-name: mike
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-packages
- dependency-name: bandit
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-packages
- dependency-name: black
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip-packages
- dependency-name: pylint
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip-packages
- dependency-name: pytest
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-packages
...

Signed-off-by: dependabot[bot] <[email protected]>

    







  








      

  
            

    

      
    

    


      

          @dependabot
dependabot
bot



            added
      

  dependencies

  Pull requests that update a dependency file

      

  python

  Pull requests that update Python code

  labels


      Sep 26, 2024

    

  



  

  

    
  


  

      

    @dependabot
dependabot
bot


    mentioned this pull request
    
      Sep 26, 2024
    





  


  

      
   Closed

  







  









      

  
      



  

  @github-actions

    
      GitHub Actions
    




  


    

      

  

    

        
    
    

  


      
          
  
      
            Copy link

  

      
    

  


  

      



      

  


  

    

  





      


        


  
    

      
          
Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.
Snapshot Warnings


⚠️: No snapshots were found for the head SHA 49e6963.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.
OpenSSF Scorecard


Scorecard details

PackageVersionScoreDetails


 pip/astroid 3.3.4
      🟢 7.7
Details
CheckScoreReason
Code-Review🟢 9Found 22/23 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 9SAST tool detected but not run on all commits


 pip/bandit 1.7.10
      🟢 6.6
Details
CheckScoreReason
Code-Review🟢 9Found 12/13 approved changesets -- score normalized to 9
Maintained🟢 1014 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Vulnerabilities🟢 91 existing vulnerabilities detected
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0


 pip/black 24.8.0
      🟢 6.5
Details
CheckScoreReason
Code-Review🟢 7Found 21/27 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0


 pip/mike 2.1.3
      🟢 3.8
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 87 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 8
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0no SAST tool detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy⚠️ 0security policy file not detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed


 pip/mkdocs-material 9.5.38
      🟢 5.3
Details
CheckScoreReason
Code-Review⚠️ 1Found 5/30 approved changesets -- score normalized to 1
Maintained🟢 1030 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 100 existing vulnerabilities detected


 pip/pylint 3.3.1
      🟢 7.2
Details
CheckScoreReason
Code-Review🟢 9Found 19/20 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
License🟢 10license file detected
CII-Best-Practices🟢 5badge detected: Passing
Signed-Releases⚠️ -1no releases found
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST🟢 9SAST tool detected but not run on all commits


 pip/pytest 8.3.3
      🟢 6.4
Details
CheckScoreReason
Code-Review🟢 9Found 10/11 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0


 pip/pyyaml 6.0.2
      🟢 6.4
Details
CheckScoreReason
Code-Review⚠️ 2Found 7/30 approved changesets -- score normalized to 2
Maintained🟢 102 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing🟢 10project is fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0


 pip/rich 13.5.3
      🟢 6.7
Details
CheckScoreReason
Code-Review⚠️ 1Found 1/6 approved changesets -- score normalized to 1
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing🟢 10project is fuzzed
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
SAST🟢 10SAST tool is run on all commits
Vulnerabilities🟢 64 existing vulnerabilities detected


 pip/semgrep 1.90.0
       UnknownUnknown


 pip/PyYAML 6.0.2
      🟢 6.4
Details
CheckScoreReason
Code-Review⚠️ 2Found 7/30 approved changesets -- score normalized to 2
Maintained🟢 102 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing🟢 10project is fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0


 pip/semgrep 1.90.0
       UnknownUnknown


Scanned Manifest Files


poetry.lock


pyproject.toml


      		
    

  





        


            

            

              
            

        

      


      

            
  

    
  
    
    

  

  



    












      

  
      



  

  @github-actions

    
      GitHub Actions
    




  


    

      

  

    

        
    
    

  


      
          
  
      
            Copy link

  

      
    

  


  

      



      

  


  

    

  





      


        


  
    

      
          

Coverage
Coverage Report 
FileStmtsMissCoverMissing
semgr8s
   __main__.py18180%5–32


   app.py81495%117, 177–178, 209


   k8s_api.py22291%43–44


   updater.py29293%49–50


TOTAL2022687% 






Tests
Skipped
Failures
Errors
Time






18
0 💤
0 ❌
0 🔥
1.661s ⏱️





      		
    

  





        


            

            

              
            

        

      


      

            
  

    
  
    
    

  

  



    












      

  
      



  

  @dependabot

    
      Dependabot
    




  


    

      

  

    

        
    
    

  


      
          
  
      
            Copy link

  

      
    

  


  

      

  
    Contributor


      

  Author


  


  

    

      

      
            dependabot
  bot

      

      

      commented

        on behalf of github

        Sep 30, 2024


      
    


  





      


        


  
    

      
          
Superseded by #383.

      		
    

  





        


            

            

              
            

        

      


      

            
  

    
  
    
    

  

  



    












      

  
            

    

      
    

    


      

          @dependabot
dependabot
bot



            closed this


      Sep 30, 2024

    

  


    


  

  
  

  
      @dependabot
  dependabot
bot

    
    deleted the
    
      
        dependabot/pip/dev/pip-packages-be898991f5
    
    branch

    September 30, 2024 21:43    
    













  
  

    

      

  




    


    

      

              

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  



      

    

  




  
    




      

  

    
    

    
  

    Reviewers
  


    

    No reviews






    

  


      
  

    Assignees
  



        

    No one assigned







      


  


  

    Labels
  



    

      

    dependencies

  Pull requests that update a dependency file
  

    python

  Pull requests that update Python code








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    
      

        
    

    Development
  



          


Successfully merging this pull request may close these issues.



  


    
  




      

    

  
      

  

    

      0 participants