The only piece of code that requires GitPython is bandit-baseline. There tends to be an abundance of CVEs in the GitPython library due to its dependency on Git. By making GitPython optional via an extra, users who mostly use just the bandit command line and not bandit-baseline can benefit.
However, this will require different install if a user wants to use bandit-baseline. This is now noted in the Getting Started doc, but you simply do:
The only piece of code that requires GitPython is bandit-baseline. There tends to be an abundance of CVEs in the GitPython library due to its dependency on Git. By making GitPython optional via an extra, users who mostly use just the bandit command line and not bandit-baseline can benefit.
However, this will require different install if a user wants to use bandit-baseline. This is now noted in the Getting Started doc, but you simply do:
pip install bandit[GitPython]FYI, this option was suggested in PR #976.