Statick

Latest version: v0.12.0

Safety actively analyzes 714772 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 3 of 14

0.9.5

Added

- Allow short flag names. (489, qdang922)
- `--output-directory` supports `-o`
- `--user-paths` supports `-u`
- Add usage examples for reporting plugins to README. (491, m0g3ns)
- Install lark as test dependency.
- Process all files at once for groovylint tool plugin. (493)
- Similar addition as in v0.9.3.

Fixed

- Updates for new tool versions. (493)
- Latest versions: black (24.1.1), npm-groovy-lint (14.2.0).
- Fixed unit tests for groovylint tool plugin.
- Handle parsing issues when CodeNarcServer errors are present.
- Update source file formatting with latest version of black.

0.9.4

Added

- Unit tests were added to the `exceptions` module with troublesome file to check for `UnicodeDecodeError`. (478)
- Unit tests were added to the `exceptions` module to check that packages to ignore are parsed correctly from
exceptions configuration file. (478)
- Unit tests were added to the `config` module to check that multi-line yaml syntax configurations are successfully
parsed. (481)
- Use multi-line yaml for tool flags in default configuration file. (481)

Fixed

- Some files cause a `UnicodeDecodeError` exception to be thrown in the `exceptions` module.
Fixed that bug and now a warning is printed if a file like that is encountered. (478)
- Fix for Dockerfile smell DL4000. (482)

Changed

- Pin version of `docformatter` dependency to be compatible with `black`.
Update docstrings to match what new version of docformatter expects. (483)
- Ran `black` and `docformatter` against all the Python test files. (479)

shell
cd tests
find . -name test_\*.py -exec black {} \;
find . -name test_\*.py -exec docformatter -i --wrap-summaries 88 --wrap-descriptions 88 {} \;


Removed

- Drop support for Python 3.7 due to end-of-life on 27 June 2023.
- See <https://endoflife.date/python>.
- Remove `codecov` package from tox configuration. (485)

0.9.3

Tools that accept a list of files have been sped up considerably.
This is the timing information of running `self_check` level against the main branch and the development branch of
the Statick repository with an AMD 3700x, Ubuntu 20.04, and Python 3.8.
The development branch shows a significant improvement in runtime performance.
The command used was

shell
./statick . --output-directory /tmp/x --level self_check --log info --timings


package | name | plugin_type | duration (v0.9.2) | duration (unreleased)
------- | ------------ | ----------- | ----------------- | ---------------------
statick | find files | Discovery | 9.2810 | 9.3033
statick | black | Tool | 4.5896 | 0.1365
statick | docformatter | Tool | 3.7007 | 0.8105
statick | isort | Tool | 4.2516 | 0.1088
statick | mypy | Tool | 6.7002 | 1.8145
statick | pydocstyle | Tool | 5.2146 | 0.8606
statick | pyflakes | Tool | 4.2164 | 0.1893
statick | pylint | Tool | 2.2831 | 2.2545
statick | shellcheck | Tool | 0.0762 | 0.0352
statick | uncrustify | Tool | 0.0001 | 0.0001
statick | xmllint | Tool | 0.0039 | 0.0037
statick | yamllint | Tool | 1.0534 | 0.1654
Overall | | | 41.4780 | 15.8050

Looking at times for Github Actions to run the `self_check` level of Statick shows improvements.

Ubuntu Version | Python Version | v0.9.1 | v0.9.2 | Unreleased
-------------- | -------------- | ------ | ------ | ----------

0.9.2

The additions to the pylint tool resulted in significant improvements to processing times.

When running the following command:

shell
statick . --output-directory /tmp/x --profile self_check.yaml --log info --timings --force-tool-list pylint


we see these time improvements.
The biggest improvement comes from running pylint once with all Python source files, followed by further improvements
from running with multiple CPU cores.
These results are from a Ryzen 5900x with 24 CPU cores available.

Statick Version | Pylint Timing Info (s)
---------------------- | ------------------------------

0.9.1

Added

- Continuous integration tests with Ubuntu 22.04. (454)
- Continuous integration tests with Python 3.11. (455)
- Docker image installs Python packages into a Python virtual environment. (448)

Changed

- Docker image installs Python tool packages from PyPI instead of apt.
Uses newer versions of Python tools. (448)
- Continuous integration uses latest versions of Actions. (454)

Fixed

- Groovylint tool plugin specifies flags for host and port to run on loopback device.
Fixes unit tests in continuous integration. (454)

Removed

- Continuous integration tests with Ubuntu 18.04. (454)

0.9.0

Added

- The new `--level` flag can be set on the command line and will override all other levels, even non-default levels
specified in a `--profile` flag when running Statick.
The expectation is that a user setting the `--level` flag will explicitly want that level for the entire Statick run
(single package or multiple packages in a workspace).
If separate levels are desired per package then the user should not use the `--level` flag. (429, 436)
- Ubuntu 22.04 is now included in the main test environment matrix when running GitHub Actions. (444)
- The `--timings` flag will print timing information to the console after a Statick run.
Timing information is available for file discovery, for each individual plugin, and for overall duration. (443)

Changed

- Default behavior for Statick will now run all available discovery plugins, and run all tool plugins where
their desired source files are available, then output results only on the terminal.
The old default behavior was to run the "sei_cert" profile, this is still doable via either of the
following arguments: `--profile sei_cert.yaml` or `--level sei_cert`. (432, 435)
- When running unit tests with tox, Statick uses pytest-flake8.
A recent upstream bug causes issues when using the latest version of pytest-flake8.
Statick is now pinning the version of pytest-flake8 to the previous major version.
Details of the upstream issue are at tholo/pytest-flake887. (440)
- Updated configuration files that come with Statick to use the recommended list format when specifying plugins on
the `inherits_from` setting. (427)

Fixed

- CMake discovery plugin and cmakelint tool plugin handle files with .cmake extension. (434)
- This follows the CMake manual at <https://cmake.org/cmake/help/latest/manual/cmake-language.7.html#organization>.
> CMake input files are written in the "CMake Language" in source files named CMakeLists.txt or ending in a
> .cmake file name extension.
- Support latest PyPI version of mypy.
Required removing a mypy ignore comment. (437)
- The ROS discovery plugin was setting the file type of the package to a boolean value rather than a string describing
the actual file type.
Mixing types between packages caused bugs in tool plugins.
The ROS discovery plugin now acts consistently with other discovery plugins. (439)

Removed

- Usage of `inherits_from` flag in configuration files as a string is no longer supported.
The levels specified in `inherits_from` must now be in list format.
The string usage has been deprecated since v0.7.1. (427)

Page 3 of 14

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.