PyCQA / PyCQA/bandit

bandit version and documentation reference in pre-commit run

Open
#1,280 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

I use bandit via pre-commit:

  - repo: https://github.com/PyCQA/bandit
    rev: 1.8.5
    hooks:
      - id: bandit

Unfortunately, the help 'More Info: ...' is invalidly referenced (version number!), for example:

Test results:
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimized byte code.
   Severity: Low Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/0.0.0/plugins/b101_assert_used.html
   Location: ...
...

Instead of https://bandit.readthedocs.io/en/0.0.0/plugins/b101_assert_used.html you could expect https://bandit.readthedocs.io/en/1.8.5/plugins/b101_assert_used.html here, but unfortunately this also leads to 404.

Reproduction steps
1. use bandit via pre-commit
2. and produce an issue in python code
Expected behavior

'More Info: ...' should link to the correct documentation:

  • Unfortunately there is no documentation for the actual release 1.8.5.
  • Unfortunately there is no documentation for release 1.8.4, too.
  • Linking to the latest documentation may also be an option.
Bandit version

1.8.3 (Default)

Python version

3.12

Additional context

Via .pre-commit-config.yaml I use bandit:

  - repo: https://github.com/PyCQA/bandit
    rev: 1.8.5
    hooks:
      - id: bandit

To get the installed version I run:

$ find ~/.cache/pre-commit/ -iname bandit
...
$ source ~/.cache/pre-commit/repoyk61p6e9/py_env-python3/bin/activate
$ bandit --version
bandit 0.0.0
  python version = 3.12.11 (main, Jun  9 2025, 08:58:11) [GCC 14.2.0]

But it is 1.8.5:

$ (cd ~/.cache/pre-commit/repo5otl2186 && git log | grep commit)
commit 23d269a665abd84597785fdf8fdda04ea89f59f3

Unfortunately I cannot select the bandit version 1.8.5 here.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reproduction in .pre-commit-config.yaml and run Bandit against Python code that triggers B101. Trace how the “More Info” URL is generated and verify which documentation target exists. Done means the reported link resolves to the appropriate plugin documentation for the installed release or a valid fallback.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
documentation, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.