Vermin

Latest version: v1.6.0

Safety actively analyzes 688944 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 6 of 9

0.8.1

Not secure
* Heuristics employed when detecting python files without extensions (23)
* Added `--help` and `-h` to show usage info (23)

Thanks to bulletmark for bringing it to my attention.

0.8.0

Not secure
Now detecting even more language features.
* Detecting self-documenting f-strings (3.8)
* Detecting `continue` in try-finally block (3.8)
* Detecting modular inverse `pow(.., -y, ..)` (3.8)
* Detecting asynchronous comprehensions (3.6)
* Detecting asynchronous generators (3.6 -> 3.7)
* Detecting `await` in comprehensions (3.6 -> 3.7)
* Detecting infix matrix multiplication `` (3.5)
* Detecting `dict` comprehensions (22, 2.7, 3.0)
* Detecting exception context cause (3.3)
* Detecting `yield from` expressions (21, 3.3)
* Detecting builtin `bytes` class from type usage
* Added 17 rules
* Introduced verbosity level 4 which currently displays user-defined symbols being ignored
* Removed unused code
* Improved test coverage
* General code improvements

Thanks to ozturkberkay for reporting issues regarding `dict` comprehensions and `yield from` expressions.

0.7.0

Not secure
* Detect position-only parameters (3.8, [PEP 570](https://www.python.org/dev/peps/pep-0570/))
* Detect named expressions (3.8, [PEP 572](https://www.python.org/dev/peps/pep-0572/))
* Detect builtin classes from type usages (`str`, `unicode`, `dict`, `set`, `frozenset`, `int`, `float`, `long`). This allows detection of `"hello".isascii()` as `str.isascii`, for instance, which enables a new set of rules
* 188 new rules added
* Print range of unique versions required by the analysed code via `--versions`:

% ./vermin.py -q --versions vermin
Minimum required versions: 2.7, 3.0
Version range: 2.0, 2.5, 2.7, 3.0

* [Analysis Exclusion](https://github.com/netromdk/vermin#analysis-exclusions) in two ways:
* ` novermin` and ` novm`:
py
import ssl
tls_version = ssl.PROTOCOL_TLSv1
if hasattr(ssl, "PROTOCOL_TLS"): novermin
tls_version = ssl.PROTOCOL_TLS

* `--exclude <symbol name>` and `--exclude-file <file name>`:

[--exclude <name>] ...
Exclude full names, like 'email.parser.FeedParser', from analysis. Useful to
ignore conditional logic that can trigger incompatible results. It's more fine
grained than lax mode.

Examples:
Exclude 'foo.bar.baz' module/member: --exclude 'foo.bar.baz'
Exclude 'foo' kwarg: --exclude 'somemodule.func(foo)'
Exclude 'bar' codecs error handler: --exclude 'ceh=bar'
Exclude 'baz' codecs encoding: --exclude 'ce=baz'

[--exclude-file <file name>] ...
Exclude full names like --exclude but from a specified file instead. Each line
constitues an exclusion with the same format as with --exclude.

* Analysis now also visits all attributes, and arguments and keywords of functions for better rule-checking coverage

Thanks to chickenbit (20) for getting me on track for detecting and adding new rules for builtin types.

0.6.3

Not secure
* Changed wording when no results were triggered to be less confusing by showing "~2" and/or "~3" when it isn't known that it won't work with py2 or py3. Before it would just show nothing in verbose mode for such files. (19, thanks hwine)
* Added results interpretation to usage info and README to better inform what "~2", "!2", and so on, means.
* Showing non-lax tip if no rules were triggered to try more thorough analysis.
* Corrected version-combining for bytesv3 (`b'test'`) by not showing "~2, 3.0" but "!2, 3.0" since if bytesv3 was triggered it is on py3 and otherwise, on py2, `type(b'test') = <type 'str'>`.

0.6.2

Not secure
A new lax mode has been implemented via argument `-l`. The analysis engine traverses the abstract syntax trees of all the Python files supplied, but it cannot evaluate any of the code (due to potential unexpected side-effects) in order to know which conditional branches will be taken at runtime. The lax mode will skip all `if`, ternarys, `for`, `while`, `try`, and boolean operations. _Note that it isn't a perfect solution._ (Thanks to vikahl for bringing it to my attention again)

Function annotations were incorrectly stating that it required Python 3.5 but they are available from 3.0. (Thanks to csernazs for noticing it). Note that variable annotations still require 3.6.

Hidden files and folders (starting with ".") will now be skipped by default because they aren't normally something expected to be included in the scan. The `--hidden` argument can be used to include them like before. (Thanks to mgedmin for the great suggestion)

Two other rules were corrected to require (2.4, 3) instead of 3.1:
* `base64.encodestring`
* `base64.decodestring`

0.6.1

Not secure
Thanks to ngtvspc, it was spotted (14) that the path detection order wasn't deterministic, i.e. the order would vary on occasion. That got fixed so the results are always the same for each successive scan.

Additionally, early Python 3.8.0b1 support has been implemented.

Page 6 of 9

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.