What's Changed

• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #1334
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1335
• Fix B608 to detect VALUES( without space by @kfess in #1337
• Add check for hardcoded passwords in dicts. by @alanverresen in #1338
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1341
• Update tox tests for Python 3.10 by @willschlitzer in #1346
• Bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by @dependabot[bot] in #1347
• Limit B614 to torch.load deserializers by @dibussoc in #1348

New Contributors

• @kfess made their first contribution in #1337
• @alanverresen made their first contribution in #1338
• @willschlitzer made their first contribution in #1346
• @dibussoc made their first contribution in #1348

Full Changelog: 1.9.2...1.9.3

What's Changed

• Argparse Python 3.14 enhancements by @ericwb in #1331
• Check whether Constant value is str by @ericwb in #1333

Full Changelog: 1.9.1...1.9.2

What's Changed

• More Python version related fixes by @ericwb in #1327

Full Changelog: 1.9.0...1.9.1

What's Changed

• Bump sigstore/cosign-installer from 3.8.2 to 3.9.0 by @dependabot in #1279
• Bump docker/setup-buildx-action from 3.10.0 to 3.11.1 by @dependabot in #1278
• added hint to FreeBSD package in doc/source/integrations.rst by @daniel-mohr in #1282
• Bump sigstore/cosign-installer from 3.9.0 to 3.9.1 by @dependabot in #1284
• Huggingface revision pinning by @lukehinds in #1281

New Contributors

• @daniel-mohr made their first contribution in #1282

Full Changelog: 1.8.5...1.8.6

What's Changed

• Fix the rendering of the CI/CD doc by @ericwb in #1274
• Fix for publish to PyPI failure by @ericwb in #1273

Full Changelog: 1.8.4...1.8.5

What's Changed

• Bump docker/build-push-action from 6.10.0 to 6.11.0 by @dependabot in #1220
• Bump docker/build-push-action from 6.11.0 to 6.12.0 by @dependabot in #1221
• Bump docker/build-push-action from 6.12.0 to 6.13.0 by @dependabot in #1222
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1229
• Update bug template to include latest released versions by @ericwb in #1218
• Add markupsafe.Markup XSS plugin by @Daverball in #1225
• Warn not error on an nonexistant test given by @ericwb in #1230
• Bump sigstore/cosign-installer from 3.7.0 to 3.8.0 by @dependabot in #1233
• Bump docker/setup-buildx-action from 3.8.0 to 3.9.0 by @dependabot in #1234
• B107: Skip None values in hardcoded password detection by @lukehinds in #1232
• Pytorch fix by @lukehinds in #1231

New Contributors

• @Daverball made their first contribution in #1225

Full Changelog: 1.8.2...1.8.3

What's Changed

• Revert "Start testing with 3.14 alphas" by @ericwb in #1217

Full Changelog: 1.8.1...1.8.2

What's Changed

• Bump docker/build-push-action from 6.9.0 to 6.10.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1209
• Update the bug template with latest bandit version by @ericwb in https://github.com/PyCQA/bandit/pull/1208
• Add Mercedes-Benz to sponsor list by @ericwb in https://github.com/PyCQA/bandit/pull/1210
• Bump docker/setup-buildx-action from 3.7.1 to 3.8.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1211
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in https://github.com/PyCQA/bandit/pull/1213
• Start testing with 3.14 alphas by @ericwb in https://github.com/PyCQA/bandit/pull/1189
• Remove lxml (B320 & B410) from blacklist by @djbrown in https://github.com/PyCQA/bandit/pull/1212
• Clarify "getting started" docs by @Flimm in https://github.com/PyCQA/bandit/pull/963

New Contributors

• @djbrown made their first contribution in https://github.com/PyCQA/bandit/pull/1212
• @Flimm made their first contribution in https://github.com/PyCQA/bandit/pull/963

Full Changelog: https://github.com/PyCQA/bandit/compare/1.8.0...1.8.1

What's Changed

• Bump docker/build-push-action from 6.7.0 to 6.9.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1178
• Rename doc file to match proper bandit ID by @ericwb in https://github.com/PyCQA/bandit/pull/1183
• Removal of Python 3.8 support by @ericwb in https://github.com/PyCQA/bandit/pull/1174
• Add more insecure cryptography cipher algorithms by @ericwb in https://github.com/PyCQA/bandit/pull/1185
• Bump docker/setup-buildx-action from 3.6.1 to 3.7.1 by @dependabot in https://github.com/PyCQA/bandit/pull/1186
• Bump sigstore/cosign-installer from 3.6.0 to 3.7.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1187
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in https://github.com/PyCQA/bandit/pull/1162
• No need to check httpx client without timeout defined by @ericwb in https://github.com/PyCQA/bandit/pull/1177
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in https://github.com/PyCQA/bandit/pull/1191
• Mark Python 3.13 as officially supported by @ericwb in https://github.com/PyCQA/bandit/pull/1192
• Update project urls with added links by @ericwb in https://github.com/PyCQA/bandit/pull/1193
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in https://github.com/PyCQA/bandit/pull/1196
• Add a JSON to seek funding from the FLOSS/fund by @ericwb in https://github.com/PyCQA/bandit/pull/1194
• Remove Sentry as a sponsor by @ericwb in https://github.com/PyCQA/bandit/pull/1198
• Remove more leftover OpenStack references by @ericwb in https://github.com/PyCQA/bandit/pull/1195

Full Changelog: https://github.com/PyCQA/bandit/compare/1.7.10...1.8.0

What's Changed

• Bump docker/build-push-action from 5.4.0 to 6.0.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1147
• Suggested small refactors in assignments by @ericwb in https://github.com/PyCQA/bandit/pull/1150
• Performance improvement in blacklist function by @ericwb in https://github.com/PyCQA/bandit/pull/1148
• Add test for usage of FTP_TLS by @ericwb in https://github.com/PyCQA/bandit/pull/1149
• New check: B113: TrojanSource - Bidirectional control characters by @Lucas-C in https://github.com/PyCQA/bandit/pull/757
• Bump docker/build-push-action from 6.0.0 to 6.1.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1152
• feat(plugins): add support for httpx in B113 by @mkniewallner in https://github.com/PyCQA/bandit/pull/1060
• Nit: remove unused variable by @ericwb in https://github.com/PyCQA/bandit/pull/1153
• Add recent releases to version choice in bug report by @ericwb in https://github.com/PyCQA/bandit/pull/1151
• Bump docker/build-push-action from 6.1.0 to 6.2.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1155
• Bump docker/build-push-action from 6.2.0 to 6.3.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1157
• Bump docker/setup-buildx-action from 3.3.0 to 3.4.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1156
• Bump docker/setup-buildx-action from 3.4.0 to 3.5.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1158
• Bump docker/login-action from 3.2.0 to 3.3.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1159
• Bump docker/build-push-action from 6.3.0 to 6.5.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1160
• Bump docker/setup-buildx-action from 3.5.0 to 3.6.1 by @dependabot in https://github.com/PyCQA/bandit/pull/1163
• Bump docker/build-push-action from 6.5.0 to 6.6.1 by @dependabot in https://github.com/PyCQA/bandit/pull/1166
• Bump sigstore/cosign-installer from 3.5.0 to 3.6.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1165
• Bump docker/build-push-action from 6.6.1 to 6.7.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1168
• Use consistent file naming of docs by @ericwb in https://github.com/PyCQA/bandit/pull/1170
• Pytorch Load / Save Plugin by @lukehinds in https://github.com/PyCQA/bandit/pull/1114

New Contributors

• @Lucas-C made their first contribution in https://github.com/PyCQA/bandit/pull/757

Full Changelog: https://github.com/PyCQA/bandit/compare/1.7.9...1.7.10

What's Changed

• Bump docker/build-push-action from 5.1.0 to 5.2.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1117
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in https://github.com/PyCQA/bandit/pull/1119
• New logo for Bandit based on raccoon by @ericwb in https://github.com/PyCQA/bandit/pull/1121
• Start testing on Python 3.13 by @ericwb in https://github.com/PyCQA/bandit/pull/1122
• Bump docker/build-push-action from 5.2.0 to 5.3.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1123
• Bump docker/setup-buildx-action from 3.1.0 to 3.2.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1124
• Bump docker/login-action from 3.0.0 to 3.1.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1125
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in https://github.com/PyCQA/bandit/pull/1126
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in https://github.com/PyCQA/bandit/pull/1127
• Bump docker/setup-buildx-action from 3.2.0 to 3.3.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1130
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in https://github.com/PyCQA/bandit/pull/1131
• Bump sigstore/cosign-installer from 3.4.0 to 3.5.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1132
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in https://github.com/PyCQA/bandit/pull/1133
• Updates banner logo so it renders well in dark mode by @ericwb in https://github.com/PyCQA/bandit/pull/1134
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in https://github.com/PyCQA/bandit/pull/1135
• Add a sponsor section to README by @ericwb in https://github.com/PyCQA/bandit/pull/1137
• Ensure sarif extra is included as part of doc build by @ericwb in https://github.com/PyCQA/bandit/pull/1139
• Bump docker/login-action from 3.1.0 to 3.2.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1142
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in https://github.com/PyCQA/bandit/pull/1143
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in https://github.com/PyCQA/bandit/pull/1145
• Guard against empty call argument list by @ericwb in https://github.com/PyCQA/bandit/pull/1146
• Bump docker/build-push-action from 5.3.0 to 5.4.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1144
• Support configfile in .bandit file by @bersbersbers in https://github.com/PyCQA/bandit/pull/1052

New Contributors

• @pre-commit-ci made their first contribution in https://github.com/PyCQA/bandit/pull/1119
• @bersbersbers made their first contribution in https://github.com/PyCQA/bandit/pull/1052

Full Changelog: https://github.com/PyCQA/bandit/compare/1.7.8...1.7.9

What's Changed

• Incorrect tag naming in readme by @lukehinds in https://github.com/PyCQA/bandit/pull/1105
• Utilize PyPI's trusted publishing by @ericwb in https://github.com/PyCQA/bandit/pull/1107
• Bump sigstore/cosign-installer from 3.3.0 to 3.4.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1109
• Add 1.7.7 to versions of bug template by @ericwb in https://github.com/PyCQA/bandit/pull/1110
• Use datetime to avoid updating copyright year by @ericwb in https://github.com/PyCQA/bandit/pull/1112
• filter data is safe for tarfile extractall by @etienneschalk in https://github.com/PyCQA/bandit/pull/1111
• Bump docker/setup-buildx-action from 3.0.0 to 3.1.0 by @dependabot in https://github.com/PyCQA/bandit/pull/1115
• [B605] Add functions that are vulnerable to shell injection. by @shihai1991 in https://github.com/PyCQA/bandit/pull/1116
• Add a SARIF output formatter by @ericwb in https://github.com/PyCQA/bandit/pull/1113

New Contributors

• @etienneschalk made their first contribution in https://github.com/PyCQA/bandit/pull/1111
• @shihai1991 made their first contribution in https://github.com/PyCQA/bandit/pull/1116

Full Changelog: https://github.com/PyCQA/bandit/compare/1.7.7...1.7.8

What's Changed

• Add the new release to bandit versions of bug template by @ericwb in https://github.com/PyCQA/bandit/pull/1075
• Bump actions/setup-python from 4 to 5 by @dependabot in https://github.com/PyCQA/bandit/pull/1076
• Handle variant in how policy is passed in paramiko by @ericwb in https://github.com/PyCQA/bandit/pull/1078
• Flag str.replace as possible sql injection by @costaparas in https://github.com/PyCQA/bandit/pull/1044
• defusedxml: Show correct module name by @kajinamit in https://github.com/PyCQA/bandit/pull/1081
• Add tidelift to the sponsor funding list by @ericwb in https://github.com/PyCQA/bandit/pull/1089
• Create a security policy by @ericwb in https://github.com/PyCQA/bandit/pull/1091
• Fix up issues found running Bandit on itself by @ericwb in https://github.com/PyCQA/bandit/pull/1093
• Add random.randbytes to blacklist calls by @ericwb in https://github.com/PyCQA/bandit/pull/1096
• Prepend ./ for files specified as CLI args by @ericwb in https://github.com/PyCQA/bandit/pull/1094
• Rework GitPython dependency to be an extra for bandit-baseline by @ericwb in https://github.com/PyCQA/bandit/pull/1099
• Bump actions/dependency-review-action from 3 to 4 by @dependabot in https://github.com/PyCQA/bandit/pull/1101
• Introduce Official Bandit Images by @lukehinds in https://github.com/PyCQA/bandit/pull/1088
• Remove markdown formatting in reStructuredText formatted README by @ericwb in https://github.com/PyCQA/bandit/pull/1103
• Downsize the org:repo name by @lukehinds in https://github.com/PyCQA/bandit/pull/1104

New Contributors

• @kajinamit made their first contribution in https://github.com/PyCQA/bandit/pull/1081

Full Changelog: https://github.com/PyCQA/bandit/compare/1.7.6...1.7.7

What's Changed

• Update bug report to include version 1.7.5 by @ericwb in https://github.com/PyCQA/bandit/pull/993
• Render Python 3.10 in drop down correctly by @ericwb in https://github.com/PyCQA/bandit/pull/997
• Remove checks for Python2 urllib by @ericwb in https://github.com/PyCQA/bandit/pull/999
• Improper detection of non-requests module by @ericwb in https://github.com/PyCQA/bandit/pull/1011
• xmlrpclib replaced with xmlrpc in Python3 by @ericwb in https://github.com/PyCQA/bandit/pull/1012
• language and linting updates by @marksmayo in https://github.com/PyCQA/bandit/pull/1015
• Adds check for crypt module usage as weak hash by @ericwb in https://github.com/PyCQA/bandit/pull/1018
• Switch to tox 4 by @mportesdev in https://github.com/PyCQA/bandit/pull/1020
• Skip unnecessary pip install commands in the pythonpackage.yml workflow by @mportesdev in https://github.com/PyCQA/bandit/pull/1021
• Update versions of used GitHub Actions by @mportesdev in https://github.com/PyCQA/bandit/pull/1024
• Update pre-commit hooks by @mportesdev in https://github.com/PyCQA/bandit/pull/1026
• Add random.Random to B311 checks by @shiftinv in https://github.com/PyCQA/bandit/pull/940
• Add a copy button to all code snippets in docs by @ericwb in https://github.com/PyCQA/bandit/pull/1030
• Replace pbr in favor of importlib by @ericwb in https://github.com/PyCQA/bandit/pull/1016
• Switch from open collective to PSF by @ericwb in https://github.com/PyCQA/bandit/pull/1031
• Make pre-commit run Bandit hook using a single process by @Klavionik in https://github.com/PyCQA/bandit/pull/1029
• Remove support for Python 3.7 due to end-of-life by @ericwb in https://github.com/PyCQA/bandit/pull/1034
• Update asserts.py documentation by @deronnax in https://github.com/PyCQA/bandit/pull/1036
• Simplify wrap_file_object by @mportesdev in https://github.com/PyCQA/bandit/pull/1037
• django_rawsql_used: support keyword arguments used in RawSQL by @kevinmarsh in https://github.com/PyCQA/bandit/pull/765
• Avoid gitpyhon CVE-2022-24439 by @carlosduelo in https://github.com/PyCQA/bandit/pull/1048
• Update blacklist call documentation by @costaparas in https://github.com/PyCQA/bandit/pull/1045
• Support ignoring blacklists by name by @costaparas in https://github.com/PyCQA/bandit/pull/1046
• Fix dependabot to update github actions by @ericwb in https://github.com/PyCQA/bandit/pull/1057
• Bump actions/checkout from 3 to 4 by @dependabot in https://github.com/PyCQA/bandit/pull/1058
• Fix for ReadtheDocs build by @ericwb in https://github.com/PyCQA/bandit/pull/1061
• fix(plugins/B507): also detect class instances by @mkniewallner in https://github.com/PyCQA/bandit/pull/1064
• Use mirror repository for black pre-commit hook by @mportesdev in https://github.com/PyCQA/bandit/pull/1070
• Add official support of Python 3.12 by @ericwb in https://github.com/PyCQA/bandit/pull/1068
• Fix crash on pyproject.toml without bandit config by @javajawa in https://github.com/PyCQA/bandit/pull/1073
• refactor: remove importlib-metadata fallback by @mkniewallner in https://github.com/PyCQA/bandit/pull/1066
• Fixes for sphinx build by @ericwb in https://github.com/PyCQA/bandit/pull/1063

New Contributors

• @marksmayo made their first contribution in https://github.com/PyCQA/bandit/pull/1015
• @shiftinv made their first contribution in https://github.com/PyCQA/bandit/pull/940
• @Klavionik made their first contribution in https://github.com/PyCQA/bandit/pull/1029
• @deronnax made their first contribution in https://github.com/PyCQA/bandit/pull/1036
• @kevinmarsh made their first contribution in https://github.com/PyCQA/bandit/pull/765
• @carlosduelo made their first contribution in https://github.com/PyCQA/bandit/pull/1048
• @costaparas made their first contribution in https://github.com/PyCQA/bandit/pull/1045
• @dependabot made their first contribution in https://github.com/PyCQA/bandit/pull/1058
• @javajawa made their first contribution in https://github.com/PyCQA/bandit/pull/1073

Full Changelog: https://github.com/PyCQA/bandit/compare/1.7.5...1.7.6

What's Changed

• Add an example screen shot of Bandit to README by @ericwb in https://github.com/PyCQA/bandit/pull/847
• Bad link to screen shot by @ericwb in https://github.com/PyCQA/bandit/pull/848
• Use a constant for weak hashes by @ericwb in https://github.com/PyCQA/bandit/pull/850
• Group location line with code output by @ericwb in https://github.com/PyCQA/bandit/pull/822
• Fix line range using Python 3.8 end_lineno by @ericwb in https://github.com/PyCQA/bandit/pull/821
• Add classifier to indicate Py3 only by @ericwb in https://github.com/PyCQA/bandit/pull/853
• Removal of blacklist call B309 httpsconnection by @ericwb in https://github.com/PyCQA/bandit/pull/858
• Remove blacklist call check for os.tempnam by @ericwb in https://github.com/PyCQA/bandit/pull/859
• Indiciate hash type in message by @ericwb in https://github.com/PyCQA/bandit/pull/860
• Add the httpx module check for verify by @ericwb in https://github.com/PyCQA/bandit/pull/861
• Add doc for hashlib plugin by @ericwb in https://github.com/PyCQA/bandit/pull/862
• Make use of rich for progress bar by @ericwb in https://github.com/PyCQA/bandit/pull/863
• Replace toml with tomli by @mkniewallner in https://github.com/PyCQA/bandit/pull/829
• Fix up B109 and B111 removed plugins docs by @ericwb in https://github.com/PyCQA/bandit/pull/864
• add check for "requests" calls without timeout by @mschfh in https://github.com/PyCQA/bandit/pull/743
• Fix for build breaks in format job by @ericwb in https://github.com/PyCQA/bandit/pull/869
• Add license and contributing links to docs by @ericwb in https://github.com/PyCQA/bandit/pull/867
• Remove redundant word Bandit in titles of sections by @ericwb in https://github.com/PyCQA/bandit/pull/873
• Add request for feedback via 👍 by @ericwb in https://github.com/PyCQA/bandit/pull/871
• Add a Discord link to the docs by @ericwb in https://github.com/PyCQA/bandit/pull/870
• Adding logging.config.listen() plugin with examples by @raj3shp in https://github.com/PyCQA/bandit/pull/874
• Removal of ghugo by @ericwb in https://github.com/PyCQA/bandit/pull/881
• Remove redundant pip line by @ericwb in https://github.com/PyCQA/bandit/pull/884
• Corrected documentation on configuration by @a-takahashi223 in https://github.com/PyCQA/bandit/pull/868
• Start testing against Python 3.11 by @mkniewallner in https://github.com/PyCQA/bandit/pull/887
• Add myself to sponsor list by @ericwb in https://github.com/PyCQA/bandit/pull/885
• Add Discord link to README by @ericwb in https://github.com/PyCQA/bandit/pull/875
• Update action versions in Actions workflows (#890) by @mportesdev in https://github.com/PyCQA/bandit/pull/893
• Add dependency review action by @ericwb in https://github.com/PyCQA/bandit/pull/891
• Fix an unclosed <b> tag in HTML formatter by @mportesdev in https://github.com/PyCQA/bandit/pull/896
• 'Test plugin listing' in docs incorrectly pointing B612 to plugin ref of B102 by @rajaramsrn in https://github.com/PyCQA/bandit/pull/897
• Make small fixes in docs by @mportesdev in https://github.com/PyCQA/bandit/pull/899
• Specify semver range for Python 3.11 by @mportesdev in https://github.com/PyCQA/bandit/pull/901
• Add another bad example of yaml load by @ericwb in https://github.com/PyCQA/bandit/pull/905
• Add releases link in "Version control integration" by @travisjungroth in https://github.com/PyCQA/bandit/pull/909
• Update version of dependency-review-action by @mportesdev in https://github.com/PyCQA/bandit/pull/911
• Avoid redundant message if debug on by @ericwb in https://github.com/PyCQA/bandit/pull/913
• Remove invalid checking on hashlib by @ericwb in https://github.com/PyCQA/bandit/pull/914
• Add some missing curve types by @ericwb in https://github.com/PyCQA/bandit/pull/920
• add jsonpickle deserialization blacklist by @SugarP1g in https://github.com/PyCQA/bandit/pull/707
• Fix reading the number argument from config file by @KAUTH in https://github.com/PyCQA/bandit/pull/923
• Add end_col_offset if available by @ericwb in https://github.com/PyCQA/bandit/pull/851
• Enhancement Proposal: Plugin "assert_used" config-skip snippet by @marianomartinelli in https://github.com/PyCQA/bandit/pull/695
• Blacklist pandas read_pickle and add functional test for it by @jaspersival in https://github.com/PyCQA/bandit/pull/710
• Docs for request without timeout has dead link by @ericwb in https://github.com/PyCQA/bandit/pull/925
• Add case for global exec by @tonybaloney in https://github.com/PyCQA/bandit/pull/570
• Fix a false positive condition yaml_load by @ericwb in https://github.com/PyCQA/bandit/pull/927
• Fix issue #453 jinja2 template select_autoescape when using jinja2.select_autoescape by @kinow in https://github.com/PyCQA/bandit/pull/454
• Adding tarfile.extractall() plugin with examples by @yilmi in https://github.com/PyCQA/bandit/pull/549
• Check for deprecated TLS 1.1 by @ericwb in https://github.com/PyCQA/bandit/pull/928
• weak_cryptographic_key assumes positional arg by @ericwb in https://github.com/PyCQA/bandit/pull/930
• Fix filename of B202 in docs by @mportesdev in https://github.com/PyCQA/bandit/pull/932
• Remove python 2 reference in docs by @ericwb in https://github.com/PyCQA/bandit/pull/933
• Pass correct number of arguments to match the %s placeholders. by @mportesdev in https://github.com/PyCQA/bandit/pull/934
• Fixup some invalid pickle testing by @ericwb in https://github.com/PyCQA/bandit/pull/924
• Fix json and yaml formatters to respect num lines by @ericwb in https://github.com/PyCQA/bandit/pull/929
• Fix AttributeError on detect of tuple assign condition by @ericwb in https://github.com/PyCQA/bandit/pull/931
• [docs] Mention exclude_dirs option available in TOML and YAML by @bittner in https://github.com/PyCQA/bandit/pull/876
• Typo fix by @PermanAtayev in https://github.com/PyCQA/bandit/pull/945
• remove py2 exec example in docs by @clavedeluna in https://github.com/PyCQA/bandit/pull/947
• Add official Python 3.11 support by @ericwb in https://github.com/PyCQA/bandit/pull/964
• DOC: Add explanation on how to use pre-commit with config file by @phofl in https://github.com/PyCQA/bandit/pull/968
• Fix breaking build due to new tox by @ericwb in https://github.com/PyCQA/bandit/pull/983
• Correct build status badge in README by @gliptak in https://github.com/PyCQA/bandit/pull/980
• Improve detecting SQL injections in f-strings by @kfrydel in https://github.com/PyCQA/bandit/pull/917
• Improve handling nosec for multi-line strings by @kfrydel in https://github.com/PyCQA/bandit/pull/915
• Check for github action updates monthly by @jlosito in https://github.com/PyCQA/bandit/pull/989
• Added a bit more project_urls by @KOLANICH in https://github.com/PyCQA/bandit/pull/985

New Contributors

• @mschfh made their first contribution in https://github.com/PyCQA/bandit/pull/743
• @raj3shp made their first contribution in https://github.com/PyCQA/bandit/pull/874
• @a-takahashi223 made their first contribution in https://github.com/PyCQA/bandit/pull/868
• @mportesdev made their first contribution in https://github.com/PyCQA/bandit/pull/893
• @rajaramsrn made their first contribution in https://github.com/PyCQA/bandit/pull/897
• @travisjungroth made their first contribution in https://github.com/PyCQA/bandit/pull/909
• @SugarP1g made their first contribution in https://github.com/PyCQA/bandit/pull/707
• @KAUTH made their first contribution in https://github.com/PyCQA/bandit/pull/923
• @marianomartinelli made their first contribution in https://github.com/PyCQA/bandit/pull/695
• @jaspersival made their first contribution in https://github.com/PyCQA/bandit/pull/710
• @kinow made their first contribution in https://github.com/PyCQA/bandit/pull/454
• @yilmi made their first contribution in https://github.com/PyCQA/bandit/pull/549
• @PermanAtayev made their first contribution in https://github.com/PyCQA/bandit/pull/945
• @clavedeluna made their first contribution in https://github.com/PyCQA/bandit/pull/947
• @phofl made their first contribution in https://github.com/PyCQA/bandit/pull/968
• @gliptak made their first contribution in https://github.com/PyCQA/bandit/pull/980
• @kfrydel made their first contribution in https://github.com/PyCQA/bandit/pull/917
• @jlosito made their first contribution in https://github.com/PyCQA/bandit/pull/989
• @KOLANICH made their first contribution in https://github.com/PyCQA/bandit/pull/985

Full Changelog: https://github.com/PyCQA/bandit/compare/1.7.4...1.7.5

What's Changed

• Fix traceback in hashlib_insecure_functions by @ericwb in https://github.com/PyCQA/bandit/pull/834
• Add version 1.7.3 to dropdown by @ericwb in https://github.com/PyCQA/bandit/pull/833
• core/config: Fix ConfigError missing argument if toml is missing by @Holzhaus in https://github.com/PyCQA/bandit/pull/845
• Add 1.7.4 in issue template by @ericwb in https://github.com/PyCQA/bandit/pull/846

New Contributors

• @Holzhaus made their first contribution in https://github.com/PyCQA/bandit/pull/845

Full Changelog: https://github.com/PyCQA/bandit/compare/1.7.3...1.7.4

What's Changed

• Rely on toml conditionally by @sigmavirus24 in https://github.com/PyCQA/bandit/pull/780
• Update issue template with latest versions by @ericwb in https://github.com/PyCQA/bandit/pull/783
• Delete release-drafter.yml by @ericwb in https://github.com/PyCQA/bandit/pull/781
• Use released version of gh-action-pypi-publish by @ericwb in https://github.com/PyCQA/bandit/pull/784
• Update publish-to-pypi.yml by @ericwb in https://github.com/PyCQA/bandit/pull/785
• Delete releasenotes directory (more openstack leftovers) by @ericwb in https://github.com/PyCQA/bandit/pull/786
• [docs] Add Getting Started chapter (migrate from README) by @bittner in https://github.com/PyCQA/bandit/pull/773
• Including CWE information by @julianthome in https://github.com/PyCQA/bandit/pull/613
• Removal of the CWEMAP dict by @ericwb in https://github.com/PyCQA/bandit/pull/789
• Fix up warnings in output of tox by @ericwb in https://github.com/PyCQA/bandit/pull/793
• Avoid printing metrics as float point numbers by @ericwb in https://github.com/PyCQA/bandit/pull/794
• Add functional test of snmp_security_check by @ericwb in https://github.com/PyCQA/bandit/pull/791
• Disable individual tests by @mikespallino in https://github.com/PyCQA/bandit/pull/597
• Change up how CWE is formatted by @ericwb in https://github.com/PyCQA/bandit/pull/788
• Check value of usedforsecurity for hashlib by @ericwb in https://github.com/PyCQA/bandit/pull/798
• Remove redundant Python 3.6 code by @ericwb in https://github.com/PyCQA/bandit/pull/802
• Add new plugin to check use of pyghmi by @ericwb in https://github.com/PyCQA/bandit/pull/803
• Check for hardcoded passwords in class attributes by @noliverio in https://github.com/PyCQA/bandit/pull/766
• Better hashlib check for Python 3.9 by @ericwb in https://github.com/PyCQA/bandit/pull/805
• Fix references to the default branch name by @ericwb in https://github.com/PyCQA/bandit/pull/810
• Cleanup the README by @ericwb in https://github.com/PyCQA/bandit/pull/809
• Show usage with no arguments by @ericwb in https://github.com/PyCQA/bandit/pull/814
• Respect color environment variables if set by @ericwb in https://github.com/PyCQA/bandit/pull/813
• Cannot seek stdin on pipe by @tylerwince in https://github.com/PyCQA/bandit/pull/496
• Test on operating systems we can support by @ericwb in https://github.com/PyCQA/bandit/pull/804
• Fix up some warnings and errors in docs by @ericwb in https://github.com/PyCQA/bandit/pull/817
• Fix root doc for readthedocs by @ericwb in https://github.com/PyCQA/bandit/pull/818
• Use versioned links to docs by @ericwb in https://github.com/PyCQA/bandit/pull/819
• Use CWE link in HTML formatter by @ericwb in https://github.com/PyCQA/bandit/pull/825
• Improve performance of linerange by @Krock21rus in https://github.com/PyCQA/bandit/pull/629
• Inaccurate message in hashlib check by @ericwb in https://github.com/PyCQA/bandit/pull/827
• Target Python >= 3.7 in pre-commit hooks by @mkniewallner in https://github.com/PyCQA/bandit/pull/830
• Center the bandit logo in readme by @ericwb in https://github.com/PyCQA/bandit/pull/823
• Build of artifact fails if raw directive used by @ericwb in https://github.com/PyCQA/bandit/pull/831

New Contributors

• @bittner made their first contribution in https://github.com/PyCQA/bandit/pull/773
• @julianthome made their first contribution in https://github.com/PyCQA/bandit/pull/613
• @noliverio made their first contribution in https://github.com/PyCQA/bandit/pull/766
• @Krock21rus made their first contribution in https://github.com/PyCQA/bandit/pull/629

Full Changelog: https://github.com/PyCQA/bandit/compare/1.7.2...1.7.3

What's Changed

• Fix broken reported URL link for B107 by @bagerard in https://github.com/PyCQA/bandit/pull/751
• test_help_arg: remove assert on 'optional arguments' by @mikelolasagasti in https://github.com/PyCQA/bandit/pull/752
• Create FUNDING.yml by @ericwb in https://github.com/PyCQA/bandit/pull/774
• Start using auto-formatters by @sigmavirus24 in https://github.com/PyCQA/bandit/pull/754
• Drop end-of-life Python 3.5 by @ericwb in https://github.com/PyCQA/bandit/pull/746
• Drop end-of-life Python 3.6 by @ericwb in https://github.com/PyCQA/bandit/pull/777
• Fixup typo by @spagh-eddie in https://github.com/PyCQA/bandit/pull/769
• Fix README.rst by @stannum-l in https://github.com/PyCQA/bandit/pull/365
• Added snmp_security check plugin for various SNMP checks by @Jed-Giblin in https://github.com/PyCQA/bandit/pull/403
• Remove leftover openstack code by @ericwb in https://github.com/PyCQA/bandit/pull/778
• Correctly define extras in setup.cfg by @mkniewallner in https://github.com/PyCQA/bandit/pull/755

New Contributors

• @bagerard made their first contribution in https://github.com/PyCQA/bandit/pull/751
• @mikelolasagasti made their first contribution in https://github.com/PyCQA/bandit/pull/752
• @sigmavirus24 made their first contribution in https://github.com/PyCQA/bandit/pull/754
• @spagh-eddie made their first contribution in https://github.com/PyCQA/bandit/pull/769
• @Jed-Giblin made their first contribution in https://github.com/PyCQA/bandit/pull/403
• @mkniewallner made their first contribution in https://github.com/PyCQA/bandit/pull/755

Full Changelog: https://github.com/PyCQA/bandit/compare/1.7.1...1.7.2

What's Changed

• Specify output_file encoding as utf-8 by @Brcrwilliams in https://github.com/PyCQA/bandit/pull/364
• Specify language_version in .pre-commit-hooks.yaml by @jdufresne in https://github.com/PyCQA/bandit/pull/670
• Clearer message for subprocess module use by @ericwb in https://github.com/PyCQA/bandit/pull/667
• Add the column offset to the issue model by @tonybaloney in https://github.com/PyCQA/bandit/pull/618
• Show column offset on all formatters by @ericwb in https://github.com/PyCQA/bandit/pull/673
• More complete removal of Python2 code by @ericwb in https://github.com/PyCQA/bandit/pull/674
• Small syntax and formatting cleanup by @ericwb in https://github.com/PyCQA/bandit/pull/676
• Updates to address docstring code scan issues, add flake8 configuration by @asears in https://github.com/PyCQA/bandit/pull/671
• More cleanup of license headers by @ericwb in https://github.com/PyCQA/bandit/pull/679
• Replace http with https URLs by @ericwb in https://github.com/PyCQA/bandit/pull/680
• Add default labels to issues by @ericwb in https://github.com/PyCQA/bandit/pull/681
• Prevent creation of blank issues by @ericwb in https://github.com/PyCQA/bandit/pull/682
• Include the line number when using HTML output format by @aludwin1 in https://github.com/PyCQA/bandit/pull/683
• Add support for Python 3.9 by @ericwb in https://github.com/PyCQA/bandit/pull/650
• Add numeric options for severity and confidence by @nathanstocking in https://github.com/PyCQA/bandit/pull/702
• #694 Bandit fails when using importlib with named arguments by @maciejstromich in https://github.com/PyCQA/bandit/pull/701
• Add license to package installation metadata by @RobbeSneyders in https://github.com/PyCQA/bandit/pull/705
• Mock part of python 3.x by @ericwb in https://github.com/PyCQA/bandit/pull/685
• Remove statement about Py3 by @ericwb in https://github.com/PyCQA/bandit/pull/713
• Use new issue template format by @ericwb in https://github.com/PyCQA/bandit/pull/717
• Fix syntax error in bug report by @ericwb in https://github.com/PyCQA/bandit/pull/718
• Remove steps in reproduce section by @ericwb in https://github.com/PyCQA/bandit/pull/719
• Fix syntax errors in bug report by @ericwb in https://github.com/PyCQA/bandit/pull/720
• document that random.choices() isn't secure either by @taybin in https://github.com/PyCQA/bandit/pull/728
• PEP-518 support: configure bandit via pyproject.toml by @orsinium in https://github.com/PyCQA/bandit/pull/401
• Always use a Loader in yaml.load by @ericwb in https://github.com/PyCQA/bandit/pull/745
• fix reading initial values from .bandit by @alipqb in https://github.com/PyCQA/bandit/pull/722

New Contributors

• @Brcrwilliams made their first contribution in https://github.com/PyCQA/bandit/pull/364
• @jdufresne made their first contribution in https://github.com/PyCQA/bandit/pull/670
• @tonybaloney made their first contribution in https://github.com/PyCQA/bandit/pull/618
• @asears made their first contribution in https://github.com/PyCQA/bandit/pull/671
• @aludwin1 made their first contribution in https://github.com/PyCQA/bandit/pull/683
• @nathanstocking made their first contribution in https://github.com/PyCQA/bandit/pull/702
• @RobbeSneyders made their first contribution in https://github.com/PyCQA/bandit/pull/705
• @taybin made their first contribution in https://github.com/PyCQA/bandit/pull/728
• @orsinium made their first contribution in https://github.com/PyCQA/bandit/pull/401
• @alipqb made their first contribution in https://github.com/PyCQA/bandit/pull/722

Full Changelog: https://github.com/PyCQA/bandit/compare/1.7.0...1.7.1

What's Changed

• Use GitHub Action badge for build by @ericwb in https://github.com/PyCQA/bandit/pull/651
• Remove universal support on the wheel by @ericwb in https://github.com/PyCQA/bandit/pull/655
• Give some tips on how to resolve B101 in the doc by @xuhdev in https://github.com/PyCQA/bandit/pull/616
• Remove blacklist call to input() by @ericwb in https://github.com/PyCQA/bandit/pull/662
• Create CODEOWNERS by @ericwb in https://github.com/PyCQA/bandit/pull/661

New Contributors

• @xuhdev made their first contribution in https://github.com/PyCQA/bandit/pull/616

Full Changelog: https://github.com/PyCQA/bandit/compare/1.6.3...1.7.0

What's Changed

• Replace setattr by @tylerwince in https://github.com/PyCQA/bandit/pull/493
• Fix 3.8 errors by @tylerwince in https://github.com/PyCQA/bandit/pull/509
• get_url returns different urls calling twice (bug #506) by @ehooo in https://github.com/PyCQA/bandit/pull/507
• fix B603 docstring by @graingert in https://github.com/PyCQA/bandit/pull/524
• --exit-zero option by @maciejstromich in https://github.com/PyCQA/bandit/pull/510
• fix the documentation file README.rst by @MrDolev in https://github.com/PyCQA/bandit/pull/533
• Cleanup comments after #510 by @florczakraf in https://github.com/PyCQA/bandit/pull/532
• Update test requirements to latest versions by @ericwb in https://github.com/PyCQA/bandit/pull/535
• Remove obsolete "sudo" keyword. by @jugmac00 in https://github.com/PyCQA/bandit/pull/538
• Remove unused bindep.txt file by @ericwb in https://github.com/PyCQA/bandit/pull/539
• Revert "Revert "Update python documentation links for version 3 counterparts"" by @ericwb in https://github.com/PyCQA/bandit/pull/540
• Add several ini options for .bandit file by @vuolter in https://github.com/PyCQA/bandit/pull/508
• Add type checking to name node of hashlib_new by @teeann in https://github.com/PyCQA/bandit/pull/516
• Add more missing ini options by @ericwb in https://github.com/PyCQA/bandit/pull/541
• Add shelve to the pickle blacklists by @auscompgeek in https://github.com/PyCQA/bandit/pull/542
• Fix readme file on Extending Bandit on list things by @MrDolev in https://github.com/PyCQA/bandit/pull/534
• Add official support of Python 3.8 by @ericwb in https://github.com/PyCQA/bandit/pull/547
• update README to add info about badge by @zachvalenta in https://github.com/PyCQA/bandit/pull/482
• Fix docs for B610,B611,B703 by @amacfie in https://github.com/PyCQA/bandit/pull/555
• Use SPDX license identifier instead of bulky headers by @ericwb in https://github.com/PyCQA/bandit/pull/530
• Add a section explaining "nosec" by @exhuma in https://github.com/PyCQA/bandit/pull/554
• replace 'then' with 'than' by @pwoolvett in https://github.com/PyCQA/bandit/pull/557
• Add sha1 to the list of insecure hashes by @ericwb in https://github.com/PyCQA/bandit/pull/561
• Use GitHub Actions to run CI by @ericwb in https://github.com/PyCQA/bandit/pull/565
• Ignore common directories by default by @ericwb in https://github.com/PyCQA/bandit/pull/544
• Add push and pull request to GH Action trigger by @ericwb in https://github.com/PyCQA/bandit/pull/567
• Add contributing file by @Glyphack in https://github.com/PyCQA/bandit/pull/572
• Fix contributing typo by @Glyphack in https://github.com/PyCQA/bandit/pull/582
• [DOC] Support python3 venv creation by @look4regev in https://github.com/PyCQA/bandit/pull/583
• Cleanup some typos in recent contributor guide by @ericwb in https://github.com/PyCQA/bandit/pull/585
• Fix colorama not being disabled after being used by @adambenali in https://github.com/PyCQA/bandit/pull/586
• Fix typo for activating venv by @bavedarnow in https://github.com/PyCQA/bandit/pull/590
• Bump pyyaml by @dosisod in https://github.com/PyCQA/bandit/pull/588
• Update CODE_OF_CONDUCT.md by @ericwb in https://github.com/PyCQA/bandit/pull/591
• Resolve 'NoneType' object has no attribute 'id'Traceback in django_mark_safe by @ehooo in https://github.com/PyCQA/bandit/pull/598
• [FIX] blacklist: fix typo in import_ftplib by @Yenthe666 in https://github.com/PyCQA/bandit/pull/601
• Add release notes project URL by @scop in https://github.com/PyCQA/bandit/pull/610
• Drop Python2 build, test, and install by @ericwb in https://github.com/PyCQA/bandit/pull/615
• Fix # noqa rendering in docs by @DrGFreeman in https://github.com/PyCQA/bandit/pull/645
• Don't show progress information on --quiet by @fniessink in https://github.com/PyCQA/bandit/pull/641
• Add skip configuration to assert_used by @wilbertom in https://github.com/PyCQA/bandit/pull/633
• GitHub Action to publish to Test PyPI by @ericwb in https://github.com/PyCQA/bandit/pull/652
• Add workflow to publish to PyPI by @ericwb in https://github.com/PyCQA/bandit/pull/653

New Contributors

• @graingert made their first contribution in https://github.com/PyCQA/bandit/pull/524
• @MrDolev made their first contribution in https://github.com/PyCQA/bandit/pull/533
• @florczakraf made their first contribution in https://github.com/PyCQA/bandit/pull/532
• @jugmac00 made their first contribution in https://github.com/PyCQA/bandit/pull/538
• @vuolter made their first contribution in https://github.com/PyCQA/bandit/pull/508
• @teeann made their first contribution in https://github.com/PyCQA/bandit/pull/516
• @auscompgeek made their first contribution in https://github.com/PyCQA/bandit/pull/542
• @zachvalenta made their first contribution in https://github.com/PyCQA/bandit/pull/482
• @amacfie made their first contribution in https://github.com/PyCQA/bandit/pull/555
• @exhuma made their first contribution in https://github.com/PyCQA/bandit/pull/554
• @pwoolvett made their first contribution in https://github.com/PyCQA/bandit/pull/557
• @Glyphack made their first contribution in https://github.com/PyCQA/bandit/pull/572
• @look4regev made their first contribution in https://github.com/PyCQA/bandit/pull/583
• @adambenali made their first contribution in https://github.com/PyCQA/bandit/pull/586
• @bavedarnow made their first contribution in https://github.com/PyCQA/bandit/pull/590
• @dosisod made their first contribution in https://github.com/PyCQA/bandit/pull/588
• @Yenthe666 made their first contribution in https://github.com/PyCQA/bandit/pull/601
• @scop made their first contribution in https://github.com/PyCQA/bandit/pull/610
• @DrGFreeman made their first contribution in https://github.com/PyCQA/bandit/pull/645
• @fniessink made their first contribution in https://github.com/PyCQA/bandit/pull/641
• @wilbertom made their first contribution in https://github.com/PyCQA/bandit/pull/633

Full Changelog: https://github.com/PyCQA/bandit/compare/1.6.2...1.6.3

What's Changed

• Performance fix by @tylerwince in https://github.com/PyCQA/bandit/pull/502

Full Changelog: https://github.com/PyCQA/bandit/compare/1.6.1...1.6.2

What's Changed

• add namespaces for parent attributes by @tylerwince in https://github.com/PyCQA/bandit/pull/492
• add test for regression and fix directory exclusion without wildcards by @mattjegan in https://github.com/PyCQA/bandit/pull/489

New Contributors

• @mattjegan made their first contribution in https://github.com/PyCQA/bandit/pull/489

Full Changelog: https://github.com/PyCQA/bandit/compare/1.6.0...1.6.1

What's Changed

• Fix custom format argument handling by @evqna in https://github.com/PyCQA/bandit/pull/380
• Add release drafter template by @evqna in https://github.com/PyCQA/bandit/pull/382
• Add option -q, --quiet, --silent to hide output by @ericwb in https://github.com/PyCQA/bandit/pull/385
• No need to skip R0204: redefined-variable-type by @ericwb in https://github.com/PyCQA/bandit/pull/390
• Allow failures on dev branch of Python 3.8 by @ericwb in https://github.com/PyCQA/bandit/pull/392
• Fix Pylint warning W0612: use of unused variables by @ericwb in https://github.com/PyCQA/bandit/pull/389
• Fix B611 doc title by @paulopontesm in https://github.com/PyCQA/bandit/pull/414
• Add pre-commit config by @KPilnacek in https://github.com/PyCQA/bandit/pull/411
• Remove unneeded trailing paren in link by @ericwb in https://github.com/PyCQA/bandit/pull/416
• Fix more info line to be in color also by @ericwb in https://github.com/PyCQA/bandit/pull/408
• Add missing custom formatter doc (#406) by @nixphix in https://github.com/PyCQA/bandit/pull/421
• Fix terminal colors not displaying properly on Windows by @GhostofGoes in https://github.com/PyCQA/bandit/pull/424
• Fix sql injection check for f-strings by @mikespallino in https://github.com/PyCQA/bandit/pull/434
• Bump PyYAML minimum version to 3.13 by @ericwb in https://github.com/PyCQA/bandit/pull/432
• Remove paramiko invoke_shell and fix example by @ericwb in https://github.com/PyCQA/bandit/pull/377
• Supporting CSafeLoader in yaml.load plugin by @domanchi in https://github.com/PyCQA/bandit/pull/436
• Properly handle nosec strings in code by @ericwb in https://github.com/PyCQA/bandit/pull/388
• Add a readthedocs build status badge by @lukehinds in https://github.com/PyCQA/bandit/pull/440
• #394 Describe baseline and it's usage in README by @BillBrower in https://github.com/PyCQA/bandit/pull/415
• Fix DeprecationWarning: invalid escape sequence by @BoboTiG in https://github.com/PyCQA/bandit/pull/441
• Fix ResourceWarning: unclosed file by @BoboTiG in https://github.com/PyCQA/bandit/pull/442
• Password by @ehooo in https://github.com/PyCQA/bandit/pull/387
• check if ast.JoinedStr exists before using it by @calvinli in https://github.com/PyCQA/bandit/pull/446
• Fix typo in README by @bitcoinhodler in https://github.com/PyCQA/bandit/pull/451
• Fix context class by @ehooo in https://github.com/PyCQA/bandit/pull/449
• Update python documentation links for version 3 counterparts by @sgaist in https://github.com/PyCQA/bandit/pull/456
• Revert "Update python documentation links for version 3 counterparts" by @ericwb in https://github.com/PyCQA/bandit/pull/461
• Redo logo on the README by @ericwb in https://github.com/PyCQA/bandit/pull/463
• Interpret wildcards in the file exclusion list by @thilp in https://github.com/PyCQA/bandit/pull/450
• updated readme links for werkzeug debugger by @sfc-gh-spandey in https://github.com/PyCQA/bandit/pull/473
• Remove pycryptodome blacklist by @mikespallino in https://github.com/PyCQA/bandit/pull/470

New Contributors

• @paulopontesm made their first contribution in https://github.com/PyCQA/bandit/pull/414
• @KPilnacek made their first contribution in https://github.com/PyCQA/bandit/pull/411
• @nixphix made their first contribution in https://github.com/PyCQA/bandit/pull/421
• @GhostofGoes made their first contribution in https://github.com/PyCQA/bandit/pull/424
• @domanchi made their first contribution in https://github.com/PyCQA/bandit/pull/436
• @BillBrower made their first contribution in https://github.com/PyCQA/bandit/pull/415
• @BoboTiG made their first contribution in https://github.com/PyCQA/bandit/pull/441
• @calvinli made their first contribution in https://github.com/PyCQA/bandit/pull/446
• @bitcoinhodler made their first contribution in https://github.com/PyCQA/bandit/pull/451
• @sgaist made their first contribution in https://github.com/PyCQA/bandit/pull/456
• @thilp made their first contribution in https://github.com/PyCQA/bandit/pull/450
• @sfc-gh-spandey made their first contribution in https://github.com/PyCQA/bandit/pull/473

Full Changelog: https://github.com/PyCQA/bandit/compare/1.5.1...1.6.0

What's Changed

• Fixed crash on dynamic import traversal by @evqna in https://github.com/PyCQA/bandit/pull/369
• New plugin to check for ignoring host keys by @rajathagasthya in https://github.com/PyCQA/bandit/pull/374
• Adding test case for traversal crash by @evqna in https://github.com/PyCQA/bandit/pull/378

New Contributors

• @rajathagasthya made their first contribution in https://github.com/PyCQA/bandit/pull/374

Full Changelog: https://github.com/PyCQA/bandit/compare/1.5.0...1.5.1

What's Changed

• Travis ci file by @lukehinds in https://github.com/PyCQA/bandit/pull/282
• Changes OpenStack specifics to PyCQA by @lukehinds in https://github.com/PyCQA/bandit/pull/1
• Migrate to new PyPI website by @ericwb in https://github.com/PyCQA/bandit/pull/2
• Create a code of conduct by @ericwb in https://github.com/PyCQA/bandit/pull/283
• Remove the unused integration tests by @ericwb in https://github.com/PyCQA/bandit/pull/285
• Create an issue template for the project by @ericwb in https://github.com/PyCQA/bandit/pull/284
• Add a build status badge to the README by @ericwb in https://github.com/PyCQA/bandit/pull/289
• Show support for Python 3.6 by @ericwb in https://github.com/PyCQA/bandit/pull/288
• Remove integration test playbooks by @ericwb in https://github.com/PyCQA/bandit/pull/290
• Update issue templates to new GitHub format by @ericwb in https://github.com/PyCQA/bandit/pull/301
• Logo design: Bandit by @baranpirincal in https://github.com/PyCQA/bandit/pull/302
• Add a smaller logo that works with the README rst by @ericwb in https://github.com/PyCQA/bandit/pull/304
• Update the doc links, remove openstack by @ericwb in https://github.com/PyCQA/bandit/pull/305
• Add missing B413 import_pycrypto in README by @ericwb in https://github.com/PyCQA/bandit/pull/308
• Add PyCryptodome to import blacklists by @warthog9 in https://github.com/PyCQA/bandit/pull/307
• Django sql injection by @ehooo in https://github.com/PyCQA/bandit/pull/292
• Use bandit.readthedocs.io in setup.cfg by @ericwb in https://github.com/PyCQA/bandit/pull/312
• Add detection for Django XSS by @ehooo in https://github.com/PyCQA/bandit/pull/295
• Add missing documentation link for B703 by @ericwb in https://github.com/PyCQA/bandit/pull/314
• Remove OpenStack-specific plugins by @nickthetait in https://github.com/PyCQA/bandit/pull/316
• Improve shell by @ehooo in https://github.com/PyCQA/bandit/pull/298
• Fast fix for yaml import by @ehooo in https://github.com/PyCQA/bandit/pull/303
• Django sql injection by @ehooo in https://github.com/PyCQA/bandit/pull/310
• Enable travis to run pylint and pep8 tox env by @ericwb in https://github.com/PyCQA/bandit/pull/325
• Add development status classifier by @ericwb in https://github.com/PyCQA/bandit/pull/321
• Remove openstack specific utils.exec checks by @ericwb in https://github.com/PyCQA/bandit/pull/328
• add os.tempnam() / os.tmpnam() to blacklist by @chair6 in https://github.com/PyCQA/bandit/pull/330
• Add Python 3.7 support by @ericwb in https://github.com/PyCQA/bandit/pull/327
• Add subprocess.run to B602 by @ericwb in https://github.com/PyCQA/bandit/pull/334
• Repair some broken see also links in the doc by @ericwb in https://github.com/PyCQA/bandit/pull/336
• Use html.escape() instead of cgi.escape() by @ericwb in https://github.com/PyCQA/bandit/pull/339
• Re-enable functional tests as part of CI by @ericwb in https://github.com/PyCQA/bandit/pull/348
• Add more_info URL to XML output by @stannum-l in https://github.com/PyCQA/bandit/pull/354
• Report dill usage by @calve in https://github.com/PyCQA/bandit/pull/347
• Add experimental Python 3.8-dev to test with by @ericwb in https://github.com/PyCQA/bandit/pull/337
• Add emojis to issue types by @ericwb in https://github.com/PyCQA/bandit/pull/358
• Add more_info URL to text output by @stannum-l in https://github.com/PyCQA/bandit/pull/359
• Add more_info URL to screen formatter by @stannum-l in https://github.com/PyCQA/bandit/pull/360
• Add support to run bandit as python -m bandit by @rtfpessoa in https://github.com/PyCQA/bandit/pull/363
• Add more_info URL to csv formatter by @stannum-l in https://github.com/PyCQA/bandit/pull/361
• Add external documentation references by @evqna in https://github.com/PyCQA/bandit/pull/368
• Change ver 1.4.1 references to 1.5.0 by @ericwb in https://github.com/PyCQA/bandit/pull/370

New Contributors

• @baranpirincal made their first contribution in https://github.com/PyCQA/bandit/pull/302
• @warthog9 made their first contribution in https://github.com/PyCQA/bandit/pull/307
• @nickthetait made their first contribution in https://github.com/PyCQA/bandit/pull/316
• @chair6 made their first contribution in https://github.com/PyCQA/bandit/pull/330
• @calve made their first contribution in https://github.com/PyCQA/bandit/pull/347
• @rtfpessoa made their first contribution in https://github.com/PyCQA/bandit/pull/363

Full Changelog: https://github.com/PyCQA/bandit/compare/1.4.0...1.5.0

• Fixing some UTF8 encoding issues in file names
• Fix up nits in the README and other files
• Drop redundant dict call
• Removing 'stats' from JSON output formatter
• Fixing partial path detection for Windows
• Add Constraints support
• Make Bandit's HTML report pass markup validation
• Remove checking for special characters in shells
• Add functional tests for B308, B321, and B402
• Handle curve keyword arg weak_cryptographic_key
• Typo in calls doc for input call
• Fix LOG marker to follow the Python 3 guideline
• Fix pylint too-many-return-statements errors

• Fixing B502 and B503 developer docs
• Fix pylint old-style-class errors
• Add capability to pipe a file into bandit
• Fix for pylint no-self-use error
• Show team and repo badges on README
• Detect binary output file (txt/html)
• Replace 'assertFalse(a in b)' with 'assertNotIn(a, b)'
• Don't include openstack/common in flake8 exclude list
• Trivial fixes based on pylint scan
• Fix typo in test_set.py
• Replace 'assertTrue(a in b)' with 'assertIn(a, b)'

• Updated from global requirements
• Updated from global requirements
• Fix unit tests for newest GitPython
• Fix blacklist filtering
• Replace 'MagicMock' with 'Mock'
• Use qualname list to avoid false positive on load()
• Enable release notes translation
• Updated from global requirements
• Updated from global requirements
• Updated from global requirements
• Updated from global requirements
• Fix a typo in test_set.py
• Update flake8 ignore list
• Fix typos in config.py & utils.py
• Adding "input()" to the blacklist calls list
• Small typo fix 'balcklist' in docstring
• Enforce no star-imports since code complies
• Fix remaining object imports and enforce the rule
• Clean imports in code
• Fix order of arguments in assertEqual
• Update defusedxml notification
• Skip key checks where size is not constant
• Show help when arguments are missing

• Fix html escaping
• Fix some errors in utils.py & calls.py
• Fix some typos in the files
• Some spelling error need to be fixed
• Remove white space between print and ()
• Add check for httpoxy vulnerability
• Fixing jenkins failing on coverage reporting
• Fix the typo in the files
• Updated from global requirements
• Remove discover from test-requirements
• Adding more plugin config docs
• Adding missing section to documentation about gen_config
• Add missing Python 3.5 classifier
• Add a py35 tox venv for upcoming py35 support
• Add reno for release notes management
• Updated from global requirements
• Allow output to default to stdout using argparse
• Updated from global requirements
• Add man page for bandit command line
• Updated from global requirements
• Updated from global requirements
• [Trivial] Remove unnecessary executable privilege
• Updated from global requirements
• Catch general exception on per-file basis
• Updated from global requirements

• Adding accurate docs for new bandit config
• Fixing a bug exposed with try, except, ... tests
• Ensure error exit codes fail integrations
• Calm down try,except,pass and try,except,continue
• Normalizing & editing command-line help text
• Added try_except_continue plugin
• Adding test IDs to test doc titles
• Fixing documentation for hardcoded password tests
• Delete the config, we dont need it now and its also invalid
• Improving config handling
• Blacklists now check node types are valid
• Fix OpenStack coverage tool
• Moving test summary to end of screen results
• Adding debug tox testenv for bandit
• Improving config generator script
• Breaking up blacklist import IDs
• The source of include/exclude conditions was incorrectly reported
• Update command line help baseline report
• Fix typos in CLI output
• Trimming Blacklists
• Updated legacy profile support
• Take2: Only use screen when terminal is tty
• Only use screen when terminal is tty
• Fixed missing new lines from Skipped file report
• Adding link to hosted docs in HTML output
• Fixing an encoding error while writing HTML
• Fixing bug when filtering blacklists
• Pass environment variables of proxy to tox
• Adding profile generation to config generator
• Additional baseline candidate test coverage
• Use bdist_wheel instead of wheel
• Legacy blacklist data is missing some expected fields
• Fixed typo in bandit/formatters/xml.py
• Missing letter in blacklist calls doc
• Removing duplicate Test ID in HTML report
• Making config optional
• Ignore all .coverage files and extensions
• Functional tests for baseline comparisons
• (re)Fixing output of bytes
• Adding docs for new style blacklist imports
• Add bandit to pep8 dependencies
• Adding JSON output for baseline results
• Fixing bug with output chars in formatters
• old blacklist imports refered to 'qualnames' as 'imports'
• Add test to compare help output with readme
• Make pep8 *the* linting interface
• Adding docs for new style blacklist calls
• Add blacklist plugins to help output
• Test names are converted to IDs before ever getting this far
• Remove ignore of F403
• Added bandit.core.manager unit tests
• Added config_generator unit tests
• Added cli.main unit tests
• Moving bandit baseline unit tests
• Old config compatibility
• Add version parameter to the command line
• Improved unit test coverage for bandit.cli.main
• Add PyPi badges
• This permits blacklist data to be filtered by ID
• Additional CLI main module unit tests
• Fixing hang in get_module_qualname_from_path
• Added unit tests for CLI main module
• Allow certain command line arguments to be passed from file
• Broken link in file jinja2_templates.py
• Misspelling in file plugins/index.rst
• This fixes the blacklist to look like a plugin so we can filter it
• Misspelling in main developers doc title
• Broken link in file mako_templates.py
• Fixing a bug and cleaning up in blacklisting code
• Cleaning code
• Adding some test coverage for config_generator
• Only decode output of subprocess
• Broken link to plugin list in file config.rst
• Support hacking H104
• Misspelling in error message in file screen.py
• Breaking out blacklists
• Bandit baseline unit tests
• Change into the project directory
• Small typo fix on the tests include/exclude
• Pretty up the formatter docs
• Updated from global requirements
• Add test ID to the output
• Add script to test bandit against projects at gate
• Update docs to include references to EC keys
• Add ftplib as a insecure protocol to use
• Added more unit tests for bandit baseline
• Update readme with latest changes
• Add missing automodule doc for yaml_load
• Allow list of tests to skip to be specified on command line
• Split yaml blacklist check into its own file
• Enable pep8 testing on tests
• Remove unnecessary absolute_import logic from modules
• Improved unit test coverage for baseline module
• Move cli modules into their own submodule
• Adding a test for test id on test plugins
• Pretty up the plugin documentation
• Changing config generator to display options
• Proper B5xx test numbering
• Remove old docs
• Allow list of tests specified on command line
• Fixed a misspelling of the word "referred"
• Allow precise #nosec placement
• Fix db error when running python34 unit tests
• Putting plugin config in code
• Split lines only once per file
• Faster loc
• Use binary mode when reading files
• use six.moves.builtins in python3
• Replace logger.warn with logger.warning
• Use == for str comparison
• Fix comment about value returned
• Correct code output on python3
• Display nice error when profile is not found
• Fix output encoding in baseline
• Fix detached head baseline
• Ensure XML goes to binary file on py3
• Fix text and html output whitespace
• Changing severity on Bandit Baseline tox target
• Adding linters target to tox.ini
• Adding new screen formatter
• Adding test IDs
• Fix codesec tox env
• Adding Bandit Baseline Tox Target
• Remove show_progress_every from Bandit config file
• Add docs for formatters

• Use sphinx autodoc to generate docs from docstring
• Move status counter to stderr
• Tweaking logger
• Adding bandit-baseline tool
• Fix multiline string with missing space
• Update README with recent changes
• Config generator: fix a typo

• Updated from global requirements
• bandit-config-generator: Add documentation
• Lowering confidence of "any_other_function_with_shell_equals_true"
• Simpler baseline matching
• Cleaning up node visitor
• Removing unused code
• Improving node visitor
• Add a configuration generator for bandit
• Add functional runtime tests

• Fixing a simple issue in results count to fix exit code

• Adding baseline capabilities to HTML formatter and update report
• Adding Baseline Capability to the Text Formatter
• Changing the way baseline formatters are indicated
• Changing issue candidates in baseline to ordered dict
• os.system et al. all spawn a shell so we should use the same logic
• Fixing bug when encountering tuple params
• Fix simple bug in text formatter excluded files list
• Improving Bandit Baseline Reporting
• blacklist_calls: add Python3 and six versions of some functions
• Test for bug 1513091

• Fixing bug in injection test

• Fixing Baseline when a filter is used
• Fixing Traceback with Bad File
• Making score sum totals more sane
• Added missing HTTP verbs to the requests checks
• Remove coverage files after run

• Adding missing docs
• Fixing some docs formatting
• Distinguish between formatted and simple commands
• Changing the confidence in the oslo secret plugin
• Adding plugin to output in text formatter
• Adding the plugin name to the HTML report
• Adding metrics and CSS styling to HTML formatter
• This adds baseline filtering to bandit
• Ensure each plugin is linked to appropriate sec guidance doc
• Add missing documentation for start_process_with_a_shell
• Collecting metrics code in one place
• Don't create files if we did not ask for them
• Add check for weak elliptic curve keys
• Add doc for weak_cryptographic_key plugin

• Adding command line option to exclude paths
• Tweaks to #nosec (+ ignore flag, - dead constant)
• Add check for Flask app debug=True usage
• Add metrics to text and JSON output formatters
• Add basic metric generation and associated tests
• Include context in debug output
• Tidy up plugin list in 'bandit -h' output

• Adding docs for Jinja2 autoescape
• Adding mako template docs
• Check for insecure cipher modes
• Adding docs for subprocess tests
• Adding docs for paramiko calls test
• Adding Linux wildcard docs
• Bad file permission docs
• Python 3 compatibility fix
• Making the /tmp file test more accurate
• Enabling new hardcoded password tests in the config
• Fixing -n behaviour
• Improved tests for hardcoded passwords
• Updated from global requirements
• Adding docs for SSL/TLS version tests
• Adding docs for try, except, pass
• Adding start_process_with_partial_path docs
• Adding docs for blacklist_imports test
• Increasing coverage of try-except-pass to 100%
• Fixing bug introduced by manager refactor
• Adding documentation for blacklist calls
• Adding "exec_used" documentation
• Removing argument printing
• Cleanup the blacklist plugin
• Cache blacklisted functions -> 5% faster
• Test coverage of manager now at 100%
• Fixing swapped parameters for issue severity and confidence
• Fix running when empty config file
• Remove tox envirnoment for pypy
• Add unit tests for bandit.core.issue
• Adding HTML formatter
• Split each formatter into separate modules
• Update .gitignore to exclude docs output
• Ignore vim swap files
• Simplifying Result Store
• Enabling coverage reporting in tox
• Dont read the wordlist file in on every test call, cache it
• Unit testing of meta_ast.py
• bad_file_permissions check: Use correct filename
• Skip '/tests/' by default
• Add known weak ciphers to blacklisted calls
• Adding "hardcoded_sql_expressions" documentation
• Adding "hardcoded_tmp_directory" documentation
• Adding "hardcoded_password" documentation
• Adding assert_used documentation
• Fix manager having no attribute '_init_logger'
• Generate module docs
• Add unit tests for the formatters
• Raise exceptions from BanditConfig rather than exit
• Removing class level variables
• Introduce wildcards to blacklist_calls plugin
• Adding unit tests for bandit.core.context.Context
• Remove redundant quotes in bandit.yaml
• meta-ast is only needed if we are in debug mode
• Adding any_other_function_with_shell_equals_true documentation
• Adding "execute_with_run_as_root_equals_true" documentation
• Adding "hardcoded_bind_all_interfaces" documentation
• Add a new check for weak RSA and DSA key sizes
• Update .gitignore for docs
• Use addCleanup rather than tearDown
• Use testtools rather than unittest
• Adding documentation for test plugins
• Adding documentation for configuration
• Additional unit test coverage for core/utils.py
• Fix typos in bandit.yaml
• Replace incorrect safe_str
• Trivial fix to beautify bandit.yaml
• Add Bytes AST support
• Variable file not defined in error path
• Adding test tool for check OpenStack projects' Bandit job
• Remove unreachable code in config.py
• Unit tests for bandit.core.config
• Adding a check for key in get_call_arg_at_position
• Py3 compatibility fix in lines_with_context() util
• Remove unused safe_unicode() utility function
• Adding check for node key in Context
• Remove unused describe_symbol() utility function
• Better function to count lines in a file
• Adding the key lookup to Context.call_args_string
• Remove unused test_basic.py
• Rename core.test_config to test_bandit
• Adding a check for call in call_args_count
• Refactoring Unit Test Directories
• Update gitignore for coverage
• Update git clone repo
• Eliminate dir(node) -> 10% faster

• Find bandit.yaml when in virtualenv

• Add other known weak MD hash modules
• Capture warnings for missing plugins or config in normal logging
• Skip a test if it requires config but none is found
• Clean up test_config
• Add info: License, Source, Bugs and Docs to README

• Actually default to /etc/ rather than just claim
• Build universal wheels for PyPI
• Update README with latest changes
• Convert README to rst
• NIT: Fix missing python 3 in classifier
• Add a confidence filter
• Rewording subprocess without shell finding
• Fixes exit code for filtered results
• Adding report timestamp
• Bug fix for SQL tests
• Adding a more informative help message for "-l"
• Activate pep8 check that _ is imported
• Add all available plugins to an example profile
• Revised XML tests
• Adding documentation framework
• Register plugins included as entry-points
• Improving SQL Injection detection
• Fixing up random to be less noisy
• Bring the logger up as soon as possible
• Bug fix in secret_config_option plugin
• Consider other hardcoded tmp paths
• Install word_list, raise exception if cannot find
• Modifying Paramiko Injection plugin
• Adding test for Try, Except, Pass
• Add tool for reporting Bandit OpenStack coverage
• Update .gitreview file for project rename
• Don't run with no tests
• Faster Bandit
• Removing statement buffer
• Adding a test for partial paths in exec functions

• Address multiline node lineno inaccuracies
• Actually rely on entry-points for formatters
• Add extension entry-points and loading
• Adding paramiko injections check to blacklist functions
• Fix config option fallback if "include" missing
• Update README with missing usage changes
• Adding verbose flag
• Log the version of Python bandit is running under
• Add notes to the README about Bandit on Python 3.4
• Clean up tests and examples for Python 3.4
• Update example files to work on Python 2 & 3
• Add Python 3.4 compatibility to bandit
• Adding documentation for SSL/TLS tests
• Adding docs for temp issues
• Use best logging practices
• Smooth over some differences with six
• Handle exception when invalid config file is specified
• Update bandit to use absolute imports
• Refactor BanditResultStore.report
• Add XML output format support

• Update the README file
• Changing config file search paths
• Adding a check for the use of Assert
• Add XML vulnerability checking
• Shift in result types & ranking scales
• Added csv output format
• Update README.rst
• Fixed issue processing files containing invalid python
• Update email to openstack-dev
• Refactored/optimized reporting code

• Fixing info output that was breaking JSON format
• fixing bandits config settings

• Fixing a bug with files listing when a file was skipped
• Fixed -n flag processing
• Fix a couple of issues with handling multi-line strings
• Fixed severity level filtering
• Fix new output file checking functionality
• Adding util methods to help handle the mix of unicode and string
• Add error checks/handing around output file case
• Fix vulnerability aggregation bug
• Fixed nosec flagging
• Moving lineno into generic visitor
• Make subprocess without `shell=True` into a plugin
• Tweaking severity for a few plugins
• Remove Python 2.6 from setup.cfg
• Correct supported Python versions in setup.cfg
• Update the config file, and use yaml.safe_load()
• Wildcard injection requires a shell
• Fixing uncaught 'InvalidModulePath' exception
• Fix a leftover tuple unpacking in reporting code
• Add tests for subprocesses and deserialization
• Fixes for node_visitor, sql and hardcoded password tests
• Add mako templating plugin and XSS profile
• Refactored AST processing
• Refactor functional tests to clarify scoring
• Clean up test property decorators after refactor
• Return the full name used in calls
• Add mock to test-requirements
• Add ceilometer to rootwrap check
• Minor cleanup for _matches_glob_list function
• Add check for secret=True on oslo password options
• assertEqual should be (expected, actual)
• Adds line ranges, DRYs code, fixes #nosec
• Add documentation for exec, yaml, jinja2 plugins
• Add list of Python values considered False
• Update jinja2 plugin to be more accurate
• Adding file discovery and directory exclusion
• Adds jinja2 autocomplete=false test
• Adds JSON output functionality
• Add rootwrap checks for neutron and cinder
• Add INFO check for any use of rootwrap
• Further decorator changes and plugin migration
• Removing un-reachable code
• Adds decorator methods for tests
• Removing warning about modules not installed in sys.path
• New constants to support updated results structure
• Adding meaningful exit codes to support use in gate
• Rename README.md to README.rst
• Update test-requirements.txt to match global requirements
• Add __repr__ to the context object
• Minor changes to profile-related debug output