Statick

Latest version: v0.9.5

Safety actively analyzes 687918 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 5 of 13

0.5.4

Added

- Add new reporting plugin that will provide JSON output to the terminal and/or to a file.
To control the plugin outputs you can add the following to your existing level configuration.

yaml
levels:
x:
discovery:
discovery_plugin:
reporting:
json:
terminal: "True"
files: "True"
tool:
tool_plugin:
flags: ""


Deprecated

- The `print_json` reporting plugin is marked as deprecated and will be removed in v0.6 series.
The functionality is completely replaced with the `json` reporting plugin.

0.5.3

Added

- Add option to the `clang-format` tool to report any issues found per line.
The per line differences are shown in diff format.
This output is an alternative to the current option of a single issue per file.
The default is to still output a single issue per file.
The ability to parse `clang-format` XML output and format in diff style was borrowed from
[ament_lint](https://github.com/ament/ament_lint), developed mainly by Dirk Thomas (dirk-thomas).

Fixed

Removed

0.5.2

Fixed

- In the Exceptions module, open files in read-only mode when filtering the lines for the NOLINT string.
Attempting to open files owned by root in read-write mode was causing a `PermissionError` and Statick would crash.

0.5.1

Added

- Allow custom configuration levels to inherit from base levels.
The base levels are either the ones that are supplied by Statick, or those set in `config.yaml` on a `--user-paths` path.
The custom configuration levels must be in a file on the `--user-paths` path.
- Automatically creating the output directory if it does not exist. (Alexander Xydes, xydesa)
- Add a reporting plugin that does nothing.
This can be helpful when a reporting plugin is required but you do not want any side effects.
One use case is piping Statick output to a separate process.
- Add documentation on how to use pytest for running a subset of unit tests.
Shows how to get line coverage and branch coverage metrics.
This can help speed up Statick developers workflow.

Fixed

- Batch all log statements inside a statick ws subprocess and only output at the end of the subprocess.
This groups all console output for a single package together.
Previously, the output from multiple packages would be interleaved and difficult to read. (Alexander Xydes, xydesa)
- Only outputting warning about docformatter failing if returncode is not 3, which is used to indicate that files
would be formatted. (Alexander Xydes, xydesa)
- Improve the deprecation warning message for the catkin discovery plugin.
Gives the version number when the plugin will be removed.
- Add documentation on how to use custom configurations for the clang-format tool.
This used to be institutinal knowledge and the usage was not clear.

0.5.0

This release adds some breaking changes to the use of Statick, but all of the old functionality can still be accessed
using the new approaches.

To scan a ROS workspace with multiple packages there used to be a separate executable named `statick_ws`.
That same functionality is now accessed via the main `statick` executable by passing in the `-ws` flag.
Anywhere that you used to use `statick_ws <workspace_directory/src>`, change that to `statick <workspace_directory/src> -ws`.

When scanning a ROS workspace all of the packages in that workspace will now be scanned in parallel.
The default number of packages to scan in parallel is half the number of CPU cores on the current computer.
This was selected as a compromise between running Statick on continuous integration servers and for local developers.
To get back to the previous behavior of scanning a single package at a time, use the flag `--max-procs 1`.
To have Statick figure out the number of available CPU cores and use all of them, use the flag `--max-procs -1`.
To use a specific number of CPU cores (`N`) up to the maximum available, use the flag `--max-procs N`.

Statick switched from raw `print()` statements to using the Python built-in logging module.
Most output is now suppressed by default.
To get back to the previous amount of output verbosity use the flag `--log INFO`.
Previously, the `--show-tool-output` flag was used to add even more verbosity.
That flag will work for the v0.5 releases, but will be removed for v0.6 releases.
Instead you should now use the flag `--log DEBUG`.

Added

- Allow `statick_ws` to scan packages in parallel using the multiprocess module. (Alexander Xydes, xydesa)
- Make `statick_ws` a `-ws` flag on the main statick executable instead of a standalone executable. (Alexander Xydes, xydesa)
- Convert use of print() and show tool output flags to the built-in Python logging module.
- Add support for yml extension to yaml discovery plugin. (Alexander Xydes, xydesa)
- Apply docformatter to format docstrings. Add that tool to the list to run at the self-check level.
- Add reporting plugin to output issues to the console in JSON format. (Alexander Xydes, xydesa)

Fixed

- Add mypy to requirements.txt.
- Remove trailing colon from filename when adding issues for black tool.
- Add parsing of black's internal parse error syntax. (Alexander Xydes, xydesa)
- Check for a valid plugin context before accessing plugin context variables related to the existence of an output directory.

Removed

- Remove unused files that are duplicated by CI files that show how to install packages.

0.4.11

Added

- A big speedup improvement of roughly 3x was implemented for the discovery phase.
The main discovery plugin will now walk through the filesystem once per package and cache information about absolute
file paths and `file` command output.
Each discovery plugin can now use that cached information instead of walking the filesystem itself. (Alexander Xydes, xydesa)
- Any directory with `COLCON_IGNORE` (and all of its subdirectories) will be ignored by `statick_ws`.
This is a standard file used by ROS2 to indicate that a ROS2 package should be ignored. (Alexander Xydes, xydesa)

Page 5 of 13

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.