Vermin

Latest version: v1.6.0

Safety actively analyzes 688931 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 5 of 9

0.10.1

Not secure
* Speed up file detection via concurrency (it uses the same number of threads specified via `-p=N`, defaulting to all cores)
* Fixed literal variable annotation detection exception and improved associated tests (40)
* Fixed security advisory by upgrading bleach from 3.1.0 to 3.1.1 (https://github.com/advisories/GHSA-q65m-pv3f-wr5r)

Thanks to JarryShaw for reporting 40.

0.10.0

Not secure
* Detect generalized unpacking (3.5, [PEP-448](https://www.python.org/dev/peps/pep-0448/))
* Detect `%` formatting and directives for `bytes` and `bytearray` (3.5, [PEP-461](https://www.python.org/dev/peps/pep-0461/))
* Detect keyword-only arguments (3.0, 37)
* ~1700 new/modified rules thanks to gousaiyang and his [Python change parser](https://github.com/gousaiyang/python-change-parser) (#34, 36)
* Big speedups to file detection by ignoring many file extensions (416) known not to contain Python source code, and by halving the number of calls to `os.stat()`
* Huge speedups to source code analysis by executing certain code fragments only once for each source file analysis, and by using `isinstance(x, y)` instead of `type(x) == y`
* Ensure ".py3, ".pyj", and ".pyi" are always analyzed in addition to ".py" and ".pyw"
* Fixed `array.array` typecode border case
* Fixed issues with kwargs handling in rare cases
* Improved format directives regex
* Fixed general border case bugs obtained by running on several Python distribution sources

A special thanks to gousaiyang who's been a great help for this release.

0.9.2

Not secure
* Added 81 new rules
* Detecting Final qualifiers (3.8, [PEP-591](https://www.python.org/dev/peps/pep-0591/))
* Detecting Literal types (3.8, [PEP-586](https://www.python.org/dev/peps/pep-0586/))
* Detect kwarg `text` of `subprocess.run` as 3.7 (33)
* Updated misc, bandit, and coverage PyPi requirements

Thanks to a-tinsmith for reporting 33.

0.9.1

Not secure
* Only display full CLI help with `--help` or `-h`. The short version is enough to understand the purpose of the program and doesn't take up too much screen estate
* Show program version via `--version`
* CLI help text explains meaning of incompatible versions notices
* Changed byte strings rule from 3+ to 2.6+/3+ for better compatibility (32)

Thanks to alalazo for bringing the byte strings issue to attention.

0.9.0

Not secure
* Backports are now supported which alter the rules slightly when applied (30). This is especially useful when migrating or if stuck with an older module.

[--backport <name>] ...
Some features are sometimes backported into packages, in repositories such as
PyPi, that are widely used but aren't in the standard language. If such a
backport is specified as being used, the results will reflect that instead.

Supported backports:
argparse - https://pypi.org/project/argparse/
configparser - https://pypi.org/project/configparser/
enum - https://pypi.org/project/enum34/
faulthandler - https://pypi.org/project/faulthandler/
typing - https://pypi.org/project/typing/

When potential backported modules are used, a tip such as the following will be shown:

Tip: You're using potentially backported modules: enum, typing
If so, try using the following for better results: --backport enum --backport typing

* All tips can be disabled by using `--no-tips`
* Changed rules from floats to tuples to support arbitrary version numbers and to be able to distinguish, for example, v3.10 from 3.1 (float)
* Fixed some tests that required an unnecessarily specific ordering of items (using `assertCountEqual()` for 3.2+ and `assertItemsEqual()` for 2.7-3)

Thanks to ngtvspc for bug fixes (31) and the idea for the backports feature (29) and testing thereof.

0.8.2

Not secure
* Ignore incompatible versions with `-i` when compatible are detected (23)
* Always attempt parsing of directly specified files (23)
* Detection and processing messages are verbose level one (23)
* Added rule for `urlparse` module (24)
* Added rule for `str.format()` (25)
* Added rule for the `with` statement (27)
* Extended target version checking for input or smaller using `-t=V-` (26)
* Added [Arch Linux](https://aur.archlinux.org/packages/vermin/) installation to README

Thanks to bulletmark, samuelb, and Gallaecio for feedback and contributions.

Page 5 of 9

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.