What's Changed

• Bump docker/build-push-action from 6.10.0 to 6.11.0 by @dependabot in #1220
• Bump docker/build-push-action from 6.11.0 to 6.12.0 by @dependabot in #1221
• Bump docker/build-push-action from 6.12.0 to 6.13.0 by @dependabot in #1222
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1229
• Update bug template to include latest released versions by @ericwb in #1218
• Add markupsafe.Markup XSS plugin by @Daverball in #1225
• Warn not error on an nonexistant test given by @ericwb in #1230
• Bump sigstore/cosign-installer from 3.7.0 to 3.8.0 by @dependabot in #1233
• Bump docker/setup-buildx-action from 3.8.0 to 3.9.0 by @dependabot in #1234
• B107: Skip None values in hardcoded password detection by @lukehinds in #1232
• Pytorch fix by @lukehinds in #1231

New Contributors

• @Daverball made their first contribution in #1225

Full Changelog: 1.8.2...1.8.3

What's Changed

• Revert "Start testing with 3.14 alphas" by @ericwb in #1217

Full Changelog: 1.8.1...1.8.2

What's Changed

• Bump docker/build-push-action from 6.9.0 to 6.10.0 by @dependabot in #1209
• Update the bug template with latest bandit version by @ericwb in #1208
• Add Mercedes-Benz to sponsor list by @ericwb in #1210
• Bump docker/setup-buildx-action from 3.7.1 to 3.8.0 by @dependabot in #1211
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1213
• Start testing with 3.14 alphas by @ericwb in #1189
• Remove lxml (B320 & B410) from blacklist by @djbrown in #1212
• Clarify "getting started" docs by @Flimm in #963

New Contributors

• @djbrown made their first contribution in #1212
• @Flimm made their first contribution in #963

Full Changelog: 1.8.0...1.8.1

What's Changed

• Bump docker/build-push-action from 6.7.0 to 6.9.0 by @dependabot in #1178
• Rename doc file to match proper bandit ID by @ericwb in #1183
• Removal of Python 3.8 support by @ericwb in #1174
• Add more insecure cryptography cipher algorithms by @ericwb in #1185
• Bump docker/setup-buildx-action from 3.6.1 to 3.7.1 by @dependabot in #1186
• Bump sigstore/cosign-installer from 3.6.0 to 3.7.0 by @dependabot in #1187
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1162
• No need to check httpx client without timeout defined by @ericwb in #1177
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1191
• Mark Python 3.13 as officially supported by @ericwb in #1192
• Update project urls with added links by @ericwb in #1193
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1196
• Add a JSON to seek funding from the FLOSS/fund by @ericwb in #1194
• Remove Sentry as a sponsor by @ericwb in #1198
• Remove more leftover OpenStack references by @ericwb in #1195

Full Changelog: 1.7.10...1.8.0

What's Changed

• Bump docker/build-push-action from 5.4.0 to 6.0.0 by @dependabot in #1147
• Suggested small refactors in assignments by @ericwb in #1150
• Performance improvement in blacklist function by @ericwb in #1148
• Add test for usage of FTP_TLS by @ericwb in #1149
• New check: B113: TrojanSource - Bidirectional control characters by @Lucas-C in #757
• Bump docker/build-push-action from 6.0.0 to 6.1.0 by @dependabot in #1152
• feat(plugins): add support for httpx in B113 by @mkniewallner in #1060
• Nit: remove unused variable by @ericwb in #1153
• Add recent releases to version choice in bug report by @ericwb in #1151
• Bump docker/build-push-action from 6.1.0 to 6.2.0 by @dependabot in #1155
• Bump docker/build-push-action from 6.2.0 to 6.3.0 by @dependabot in #1157
• Bump docker/setup-buildx-action from 3.3.0 to 3.4.0 by @dependabot in #1156
• Bump docker/setup-buildx-action from 3.4.0 to 3.5.0 by @dependabot in #1158
• Bump docker/login-action from 3.2.0 to 3.3.0 by @dependabot in #1159
• Bump docker/build-push-action from 6.3.0 to 6.5.0 by @dependabot in #1160
• Bump docker/setup-buildx-action from 3.5.0 to 3.6.1 by @dependabot in #1163
• Bump docker/build-push-action from 6.5.0 to 6.6.1 by @dependabot in #1166
• Bump sigstore/cosign-installer from 3.5.0 to 3.6.0 by @dependabot in #1165
• Bump docker/build-push-action from 6.6.1 to 6.7.0 by @dependabot in #1168
• Use consistent file naming of docs by @ericwb in #1170
• Pytorch Load / Save Plugin by @lukehinds in #1114

New Contributors

• @Lucas-C made their first contribution in #757

Full Changelog: 1.7.9...1.7.10

What's Changed

• Bump docker/build-push-action from 5.1.0 to 5.2.0 by @dependabot in #1117
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1119
• New logo for Bandit based on raccoon by @ericwb in #1121
• Start testing on Python 3.13 by @ericwb in #1122
• Bump docker/build-push-action from 5.2.0 to 5.3.0 by @dependabot in #1123
• Bump docker/setup-buildx-action from 3.1.0 to 3.2.0 by @dependabot in #1124
• Bump docker/login-action from 3.0.0 to 3.1.0 by @dependabot in #1125
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1126
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1127
• Bump docker/setup-buildx-action from 3.2.0 to 3.3.0 by @dependabot in #1130
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1131
• Bump sigstore/cosign-installer from 3.4.0 to 3.5.0 by @dependabot in #1132
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1133
• Updates banner logo so it renders well in dark mode by @ericwb in #1134
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1135
• Add a sponsor section to README by @ericwb in #1137
• Ensure sarif extra is included as part of doc build by @ericwb in #1139
• Bump docker/login-action from 3.1.0 to 3.2.0 by @dependabot in #1142
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1143
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1145
• Guard against empty call argument list by @ericwb in #1146
• Bump docker/build-push-action from 5.3.0 to 5.4.0 by @dependabot in #1144
• Support configfile in .bandit file by @bersbersbers in #1052

New Contributors

• @pre-commit-ci made their first contribution in #1119
• @bersbersbers made their first contribution in #1052

Full Changelog: 1.7.8...1.7.9

What's Changed

• Incorrect tag naming in readme by @lukehinds in #1105
• Utilize PyPI's trusted publishing by @ericwb in #1107
• Bump sigstore/cosign-installer from 3.3.0 to 3.4.0 by @dependabot in #1109
• Add 1.7.7 to versions of bug template by @ericwb in #1110
• Use datetime to avoid updating copyright year by @ericwb in #1112
• filter data is safe for tarfile extractall by @etienneschalk in #1111
• Bump docker/setup-buildx-action from 3.0.0 to 3.1.0 by @dependabot in #1115
• [B605] Add functions that are vulnerable to shell injection. by @shihai1991 in #1116
• Add a SARIF output formatter by @ericwb in #1113

New Contributors

• @etienneschalk made their first contribution in #1111
• @shihai1991 made their first contribution in #1116

Full Changelog: 1.7.7...1.7.8

What's Changed

• Add the new release to bandit versions of bug template by @ericwb in #1075
• Bump actions/setup-python from 4 to 5 by @dependabot in #1076
• Handle variant in how policy is passed in paramiko by @ericwb in #1078
• Flag str.replace as possible sql injection by @costaparas in #1044
• defusedxml: Show correct module name by @kajinamit in #1081
• Add tidelift to the sponsor funding list by @ericwb in #1089
• Create a security policy by @ericwb in #1091
• Fix up issues found running Bandit on itself by @ericwb in #1093
• Add random.randbytes to blacklist calls by @ericwb in #1096
• Prepend ./ for files specified as CLI args by @ericwb in #1094
• Rework GitPython dependency to be an extra for bandit-baseline by @ericwb in #1099
• Bump actions/dependency-review-action from 3 to 4 by @dependabot in #1101
• Introduce Official Bandit Images by @lukehinds in #1088
• Remove markdown formatting in reStructuredText formatted README by @ericwb in #1103
• Downsize the org:repo name by @lukehinds in #1104

New Contributors

• @kajinamit made their first contribution in #1081

Full Changelog: 1.7.6...1.7.7

What's Changed

• Update bug report to include version 1.7.5 by @ericwb in #993
• Render Python 3.10 in drop down correctly by @ericwb in #997
• Remove checks for Python2 urllib by @ericwb in #999
• Improper detection of non-requests module by @ericwb in #1011
• xmlrpclib replaced with xmlrpc in Python3 by @ericwb in #1012
• language and linting updates by @marksmayo in #1015
• Adds check for crypt module usage as weak hash by @ericwb in #1018
• Switch to tox 4 by @mportesdev in #1020
• Skip unnecessary pip install commands in the pythonpackage.yml workflow by @mportesdev in #1021
• Update versions of used GitHub Actions by @mportesdev in #1024
• Update pre-commit hooks by @mportesdev in #1026
• Add random.Random to B311 checks by @shiftinv in #940
• Add a copy button to all code snippets in docs by @ericwb in #1030
• Replace pbr in favor of importlib by @ericwb in #1016
• Switch from open collective to PSF by @ericwb in #1031
• Make pre-commit run Bandit hook using a single process by @Klavionik in #1029
• Remove support for Python 3.7 due to end-of-life by @ericwb in #1034
• Update asserts.py documentation by @deronnax in #1036
• Simplify wrap_file_object by @mportesdev in #1037
• django_rawsql_used: support keyword arguments used in RawSQL by @kevinmarsh in #765
• Avoid gitpyhon CVE-2022-24439 by @carlosduelo in #1048
• Update blacklist call documentation by @costaparas in #1045
• Support ignoring blacklists by name by @costaparas in #1046
• Fix dependabot to update github actions by @ericwb in #1057
• Bump actions/checkout from 3 to 4 by @dependabot in #1058
• Fix for ReadtheDocs build by @ericwb in #1061
• fix(plugins/B507): also detect class instances by @mkniewallner in #1064
• Use mirror repository for black pre-commit hook by @mportesdev in #1070
• Add official support of Python 3.12 by @ericwb in #1068
• Fix crash on pyproject.toml without bandit config by @javajawa in #1073
• refactor: remove importlib-metadata fallback by @mkniewallner in #1066
• Fixes for sphinx build by @ericwb in #1063

New Contributors

• @marksmayo made their first contribution in #1015
• @shiftinv made their first contribution in #940
• @Klavionik made their first contribution in #1029
• @deronnax made their first contribution in #1036
• @kevinmarsh made their first contribution in #765
• @carlosduelo made their first contribution in #1048
• @costaparas made their first contribution in #1045
• @dependabot made their first contribution in #1058
• @javajawa made their first contribution in #1073

Full Changelog: 1.7.5...1.7.6

What's Changed

• Add an example screen shot of Bandit to README by @ericwb in #847
• Bad link to screen shot by @ericwb in #848
• Use a constant for weak hashes by @ericwb in #850
• Group location line with code output by @ericwb in #822
• Fix line range using Python 3.8 end_lineno by @ericwb in #821
• Add classifier to indicate Py3 only by @ericwb in #853
• Removal of blacklist call B309 httpsconnection by @ericwb in #858
• Remove blacklist call check for os.tempnam by @ericwb in #859
• Indiciate hash type in message by @ericwb in #860
• Add the httpx module check for verify by @ericwb in #861
• Add doc for hashlib plugin by @ericwb in #862
• Make use of rich for progress bar by @ericwb in #863
• Replace toml with tomli by @mkniewallner in #829
• Fix up B109 and B111 removed plugins docs by @ericwb in #864
• add check for "requests" calls without timeout by @mschfh in #743
• Fix for build breaks in format job by @ericwb in #869
• Add license and contributing links to docs by @ericwb in #867
• Remove redundant word Bandit in titles of sections by @ericwb in #873
• Add request for feedback via 👍 by @ericwb in #871
• Add a Discord link to the docs by @ericwb in #870
• Adding logging.config.listen() plugin with examples by @raj3shp in #874
• Removal of ghugo by @ericwb in #881
• Remove redundant pip line by @ericwb in #884
• Corrected documentation on configuration by @a-takahashi223 in #868
• Start testing against Python 3.11 by @mkniewallner in #887
• Add myself to sponsor list by @ericwb in #885
• Add Discord link to README by @ericwb in #875
• Update action versions in Actions workflows (#890) by @mportesdev in #893
• Add dependency review action by @ericwb in #891
• Fix an unclosed tag in HTML formatter by @mportesdev in #896
• 'Test plugin listing' in docs incorrectly pointing B612 to plugin ref of B102 by @rajaramsrn in #897
• Make small fixes in docs by @mportesdev in #899
• Specify semver range for Python 3.11 by @mportesdev in #901
• Add another bad example of yaml load by @ericwb in #905
• Add releases link in "Version control integration" by @travisjungroth in #909
• Update version of dependency-review-action by @mportesdev in #911
• Avoid redundant message if debug on by @ericwb in #913
• Remove invalid checking on hashlib by @ericwb in #914
• Add some missing curve types by @ericwb in #920
• add jsonpickle deserialization blacklist by @SugarP1g in #707
• Fix reading the number argument from config file by @KAUTH in #923
• Add end_col_offset if available by @ericwb in #851
• Enhancement Proposal: Plugin "assert_used" config-skip snippet by @marianomartinelli in #695
• Blacklist pandas read_pickle and add functional test for it by @jaspersival in #710
• Docs for request without timeout has dead link by @ericwb in #925
• Add case for global exec by @tonybaloney in #570
• Fix a false positive condition yaml_load by @ericwb in #927
• Fix issue #453 jinja2 template select_autoescape when using jinja2.select_autoescape by @kinow in #454
• Adding tarfile.extractall() plugin with examples by @yilmi in #549
• Check for deprecated TLS 1.1 by @ericwb in #928
• weak_cryptographic_key assumes positional arg by @ericwb in #930
• Fix filename of B202 in docs by @mportesdev in #932
• Remove python 2 reference in docs by @ericwb in #933
• Pass correct number of arguments to match the %s placeholders. by @mportesdev in #934
• Fixup some invalid pickle testing by @ericwb in #924
• Fix json and yaml formatters to respect num lines by @ericwb in #929
• Fix AttributeError on detect of tuple assign condition by @ericwb in #931
• [docs] Mention exclude_dirs option available in TOML and YAML by @bittner in #876
• Typo fix by @PermanAtayev in #945
• remove py2 exec example in docs by @clavedeluna in #947
• Add official Python 3.11 support by @ericwb in #964
• DOC: Add explanation on how to use pre-commit with config file by @phofl in #968
• Fix breaking build due to new tox by @ericwb in #983
• Correct build status badge in README by @gliptak in #980
• Improve detecting SQL injections in f-strings by @kfrydel in #917
• Improve handling nosec for multi-line strings by @kfrydel in #915
• Check for github action updates monthly by @jlosito in #989
• Added a bit more project_urls by @KOLANICH in #985