aio-libs / aio-libs/aiosmtpd

Is release.py still used?

Open
#613 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
373
Forks
105
Avg merge
4m
Merged PRs (30d)
2

Description

Replacing direct use of bandit with flake8-bandit causes `housekeep.py` to be scanned for security issues:
```
flake8 aiosmtpd housekeep.py release.py setup.py --select S
pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
Unable to find qualified name for module: housekeep.py
Unable to find qualified name for module: release.py
Unable to find qualified name for module: setup.py
release.py:101:1: S603 subprocess call - check for execution of untrusted input.
release.py:103:1: S603 subprocess call - check for execution of untrusted input.
release.py:109:1: S603 subprocess call - check for execution of untrusted input.
release.py:126:1: S603 subprocess call - check for execution of untrusted input.
release.py:141:1: S603 subprocess call - check for execution of untrusted input.
release.py:156:1: S607 Starting a process with a partial executable path
release.py:156:1: S603 subprocess call - check for execution of untrusted input.
release.py:158:1: S607 Starting a process with a partial executable path
release.py:158:1: S603 subprocess call - check for execution of untrusted input.
```
If it is not used the simplest solution would be to delete it. Otherwise the detected issues need to be reviewed and addressed.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.