assert_used skips change in 1.7.7
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 836
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
Had pyproject.toml containing the following which worked fine in 1.7.6:
[tool.bandit.assert_used]
skips = [
'src/tests/*_test.py',
]
This fails in 1.7.7 unless changed to:
[tool.bandit.assert_used]
skips = [
'./src/tests/*_test.py',
]
This new config works in 1.7.7, but not 1.7.6.
Given this was only a subminor release, I am assuming that this behaviour change was unintentional as I wouldn't think a subminor release should require a change to config files.
Reproduction steps
1. Have some test file located at src/tests/my_test.py with an assert
2. Have code snippet from above in pyproject.toml
3. Run bandit with 1.7.6 and 1.7.7
Expected behavior
Expect that config files shouldn't require modification on a subminor release.
Bandit version
1.7.6 (Default)
Python version
3.12 (Default)
Additional context
For some reason I cannot report a bandit verison of 1.7.7 in the bandit version dropdown box so have left that at 1.7.6.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the behavior with pyproject.toml and src/tests/my_test.py using Bandit 1.7.6 and 1.7.7, then trace how the assert_used skips pattern is interpreted. Done means the existing src/tests/*_test.py configuration behaves consistently across the two versions without requiring a config change.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100