Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Rework GitPython dependency to be an extra for bandit-baseline #1099

Merged
merged 1 commit into from
Jan 21, 2024
Merged

Rework GitPython dependency to be an extra for bandit-baseline #1099

merged 1 commit into from
Jan 21, 2024

Commits on Jan 21, 2024

  1. Rework GitPython dependency to be an extra for bandit-baseline 

    The only piece of code that requires GitPython is bandit-baseline.
There tends to be an abundance of CVEs in the GitPython library
due to its dependency on Git. By making GitPython optional via
an extra, users who mostly use just the bandit command line and
not bandit-baseline can benefit.

However, this will require different install if a user wants to
use bandit-baseline. This is now noted in the Getting Started
doc, but you simply do:

pip install bandit[GitPython]

FYI, this option was suggested in PR PyCQA#976.

PyCQA#976

Signed-off-by: Eric Brown <[email protected]>
    @ericwb
    ericwb committed Jan 21, 2024
    Configuration menu
    Copy the full SHA
    a354d7b View commit details
    Browse the repository at this point in the history