Safety 2.0.0 and Safety GitHub Action - Python Dependency Scanner
PyUp is excited to release Safety 2.0 CLI and Safety as a GitHub Action!
Compared to previous versions, Safety 2.0 will be a significant update that includes new features and refactors, resulting in breaking changes to some inputs and outputs. The new GitHub Action enables you to configure Python dependency security and compliance scans on your repositories on new commits, new branches, pull requests, and more.
Summary:
Safety 2.0 major release (notes below) and GitHub Action release
Fixed #423: Bare output includes extra line in non-screen output with no vulnerabilities.
Fixed #422: ResourceWarning (unclosed socket) in safety v.2.3.1.
Fixed telemetry data missing when the CLI mode is used.
Fixed wrong database fetching when the KEY and the database arguments are used at the same time.
Added SAFETY_PURE_YAML env var, used for cases that require pure Python in the YAML parser.
[2.3.1] - 2022-10-05
Add safety.alerts module to setup.cfg
[2.3.0] - 2022-10-05
Safety can now create GitHub PRs and Issues for vulnerabilities directly, with the new safety alert subcommand.
Support for GitHub PR and Issue alerting has been added to the GitHub Action.
[2.2.1] - 2022-10-04
Fixed the use of the SAFETY_COLOR environment variable
Fixed bug in the case of vulnerabilities without a CVE linked
Fixed GitHub version in the README
[2.2.0] - 2022-09-19
Safety starts to use dparse to parse files, now Safety supports mainly Poetry and Pipenv lock files plus other files supported by dparse.
Added logic for custom integrations like pipenv check.
The --db flag is compatible remote sources too.
Added more logging
Upgrade dparse dependency to avoid a possible ReDos security issue
Removed Travis and Appveyor, the CI/CD was migrated to GitHub Actions
[2.1.1] - 2022-07-18
Fix crash when running on systems without git present (Thanks @andyjones)
[2.1.0] - 2022-07-14
Summary:
Improved error messages & fixed issues with proxies
Fixed license command
Added the ability for scan outputs to be sent to pyup.io. This will only take effect if using an API key, the feature is enabled on your profile, and the --disable-audit-and-monitor is not set
Added the ability to have a Safety policy file set centrally on your pyup.io profile. This remote policy file will be used if there's no local policy file present, otherwise a warning will be issued.
Updated outputs:
Text & screen output: If a scan has been logged, this is now mentioned in the output.
JSON output: The JSON output now includes git metadata about the folder Safety was run in. It also includes a version field, and telemetry information that would be sent separately. There are no breaking changes in the output.
New inputs:
New command line flags
The --disable-audit-and-monitor flag can be set to disable sending a scan's result to pyup.io
The --project flag can be set to manually specify a project to associate these scans with. By default, it'll autodetect based on the current folder and git.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot]
commented
2 years ago
Bumps safety from 1.10.3 to 2.3.2.
Release notes
Sourced from safety's releases.
... (truncated)
Changelog
Sourced from safety's changelog.
... (truncated)
Commits
f55c927Version 2.3.2a8c8c96Merge pull request #429 from pyupio/developd180854Revert "Remove ignore flags in the CI config."7eef5a4Remove ignore flags in the CI config.7171e3eMerge pull request #428 from pyupio/maine7b4c0cMerge pull request #427 from pyupio/fix/integrations14db471Fix announcements load and telemetry.be1a7a8Send announcements to stderr when not isatty only when the type announcement ...6cd1ae3Fix logic output for integrations, resource warnings fixed, and ruamel fix.f1b86b8Merge pull request #426 from pyupio/developDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)