Guarddog

What's Changed

Bug fixes:
* Fix a bug where a remote target could be considered a local one by mistake (144)

Chores:
* Bump ujson from 5.4.0 to 5.7.0 by dependabot in https://github.com/DataDog/guarddog/pull/143
* Bump jsonschema from 4.9.1 to 4.17.3 by dependabot in https://github.com/DataDog/guarddog/pull/142
* Bump websocket-client from 1.3.3 to 1.5.1 by dependabot in https://github.com/DataDog/guarddog/pull/141
* Bump requests from 2.28.1 to 2.28.2 by dependabot in https://github.com/DataDog/guarddog/pull/140
* Bump pathos from 0.2.9 to 0.3.0 by dependabot in https://github.com/DataDog/guarddog/pull/139

**Full Changelog**: https://github.com/DataDog/guarddog/compare/v1.0.0...v1.0.1

This is a new major version with breaking changes.

What's Changed

**Breaking changes:**
* The commands `guarddog scan` and `guarddog verify` have been deprecated and will be removed in an upcoming version. Use `guarddog pypi scan` and `guarddog pypi verify` instead


New features:
* Added support for scanning npm packages (`guarddog npm scan`) and package.json (`guarddog npm verify`)
* Support SARIF output to allow for easy use with GitHub Code Scanning
* Added commands `guarddog pypi list-rules` and `guarddog npm list-rules`
* Support verbose debugging output through `guarddog --log-level debug ...`

New heuristics:
* New Python heuristic `silent-process-execution` to identify packages silently executing processes, similar to the Pytorch attack
* New PyPI metadata heuristic: `repository_integrity_mismatch` compares the contents of a package on PyPI with its contents on GitHub, and flags packages that have extraneous or modified files not reflected on GitHub
* New npm heuristic: typosquatting
* New npm heuristic: detecting silent process execution
* New npm heuristic: detecting post and pre-install hooks
* New npm heuristic: detecting when a npm package serializes `process.env`

Cosmetics:
* GuardDog now has an official logo!
* README heuristics documentation is now automatically generated and injected in the README

Minor changes:
* chores: Bump certify version to fix GHSA-43fp-rhv2-5gv8

**Full Changelog**: https://github.com/DataDog/guarddog/compare/v0.1.10...v1.0.0

What's Changed
* Add pre-commit hooks configuration for local development by christophetd in https://github.com/DataDog/guarddog/pull/107
* Fixing False Positives and Duplicate Errors in the Typosquatting Algorithm by QuinceyJames in https://github.com/DataDog/guarddog/pull/108

New Contributors
* QuinceyJames made their first contribution in https://github.com/DataDog/guarddog/pull/108

**Full Changelog**: https://github.com/DataDog/guarddog/compare/v0.1.9...v0.1.10

What's Changed
* Bug fix: scanning zip packages by christophetd in https://github.com/DataDog/guarddog/pull/105
* Heuristic: identify usage of globals and __import__ (closes 62) by christophetd in https://github.com/DataDog/guarddog/pull/106


**Full Changelog**: https://github.com/DataDog/guarddog/compare/v0.1.8...v0.1.9

What's Changed
* Add python version pin for pyproject.toml and update README by zmallen in https://github.com/DataDog/guarddog/pull/94
* pyproject.toml: Add repository url by materro in https://github.com/DataDog/guarddog/pull/97
* Add Type checking and enforce lint by vdeturckheim in https://github.com/DataDog/guarddog/pull/98
* Add Semgrep rule and run custom Semgrep rules in CI for SAST by christophetd in https://github.com/DataDog/guarddog/pull/102

New Contributors
* zmallen made their first contribution in https://github.com/DataDog/guarddog/pull/94
* materro made their first contribution in https://github.com/DataDog/guarddog/pull/97

**Full Changelog**: https://github.com/DataDog/guarddog/compare/v0.1.7...v0.1.8

What's Changed
* Handle requirement file parsing errors by vdeturckheim in https://github.com/DataDog/guarddog/pull/96, closes #88

**Full Changelog**: https://github.com/DataDog/guarddog/compare/v0.1.6...v0.1.7