Creosote

Latest version: v3.0.0

Safety actively analyzes 622882 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 1 of 5

3.0.0

㊗️ Major (backwards-compat breaking changes)

- Dropped Python 3.7 support.
- Some CLI arguments have been renamed.
- Certain CLI arguments must now be repeated rather than having multiple values supplied to one and the same argument.

For exact details on the CLI argument changes, see the migration guide (attached at the bottom of these release notes and in the [README](https://github.com/fredrikaverpil/creosote?tab=readme-ov-file#-migration-guide-creosote-2x-to-3x)).

🐸 Minor (new features)

- The ability to configure creosote using `pyproject.toml` (❤️🙏 BrianPugh 183 `hacktoberfest-accepted`). See the [README](https://github.com/fredrikaverpil/creosote?tab=readme-ov-file#using-pyprojecttoml) for more details.
- Python 3.12 support.

🐞 Patch (bug fixes)

- When excluding dependencies, there could be a falsy warning shown because the dependency name entered on the command line was not "canonicalized" (dashes and periods in package names are made into underscores internally).

🫁 Internal (test suite)

- Overhauled test suite with better integration tests and better pytest fixtures. Hopefully the whole setup is a lot more approachable now.

🌀 Migration guide: creosote 2.x to 3.x

Creosote was updated to 3.0.0 because the way arguments were supplied has now changed. This also brings `pyproject.toml` configuration support.

Argument name change

The argument naming has changed:

| 2.x argument name | 3.x argument name |
| ----------------- | ----------------- |
| `--exclude-deps` | `--exclude-dep` |
| `--paths` | `--path` |
| `--sections` | `--section` |

Multiple argument values

With creosote 2.x, you were able to provide multiple values following some arguments, example:

bash
creosote -p file1.py file2.py


With creosote 3.x, you must now provide multiple arguments as a key/value pair:

bash
creosote -p file1.py -p file2.py


This new creosote 3.x behavior applies to the following 3.x CLI arguments:

- `--venv`
- `--exclude-dep`
- `-p` or `--path`
- `-s` or `--section`

2.6.3

Fixes

- Bugfix for when using `Pipfile` 174
- Bugfix for when using PEP621 optional dependencies 175

2.6.2

Fixes

- Fixes a problem for PEP-582 / PDM users, who would like to point their venv to the `__pypackages__` folder. Although PEP-582 was rejected, this is very easy to support right now. As long as this is easy to support, I see no issue with supporting PEP-582 and `__pypackages__`. 171

2.6.1

Fixes (should maybe have been features)

- Bumped Loguru dependency to support 0.7.0.
- Just trying out the new trusted publishing workflow. For more info:
- https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/
- https://github.com/pypa/gh-action-pypi-publish

2.6.0

Features

- The venv's `RECORD` file was read _only_ if no `top_level.txt` file was found in the venv. This behavior has changed, so that both the `top_level.txt` and `RECORD` files are always read now. This is done to simply increase the chance to find a correlation between the dependency name and its import name.
- Before version 2.6.0, creosote used `distlib.database` to read the `RECORD` file. This code was cleaned up and the dependency on `distlib` has been removed.

2.6.0rc1

Features

- In addition to checking the venv's `top_level.txt` file for the dependency's import name, creosote used to check the venv's `RECORD` file, using `distlib.database`. This code was cleaned up a bit, and the dependency of `distlib` was removed.
- If the venv's `top_level.txt` file (for the given dependency) was found, the `RECORD` file check was not performed in Creosote 2.5.0. In this release this behavior is changed and the `RECORD` file check is always being performed. The reason for doing this is simply to increase the chances of finding the dependency's import name.
- The dependency on `distlib` was removed.

Page 1 of 5

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.