PyCQA / PyCQA/bandit

assert_used skips change in 1.7.7

Open
#1,106 2 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

Had pyproject.toml containing the following which worked fine in 1.7.6:

[tool.bandit.assert_used]
skips = [
  'src/tests/*_test.py',
]

This fails in 1.7.7 unless changed to:

[tool.bandit.assert_used]
skips = [
  './src/tests/*_test.py',
]

This new config works in 1.7.7, but not 1.7.6.

Given this was only a subminor release, I am assuming that this behaviour change was unintentional as I wouldn't think a subminor release should require a change to config files.

Reproduction steps
1. Have some test file located at src/tests/my_test.py with an assert
2. Have code snippet from above in pyproject.toml
3. Run bandit with 1.7.6 and 1.7.7
Expected behavior

Expect that config files shouldn't require modification on a subminor release.

Bandit version

1.7.6 (Default)

Python version

3.12 (Default)

Additional context

For some reason I cannot report a bandit verison of 1.7.7 in the bandit version dropdown box so have left that at 1.7.6.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the behavior with pyproject.toml and src/tests/my_test.py using Bandit 1.7.6 and 1.7.7, then trace how the assert_used skips pattern is interpreted. Done means the existing src/tests/*_test.py configuration behaves consistently across the two versions without requiring a config change.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.