Bump bandit from 1.7.4 to 1.7.7

[dependabot[bot]]

Bumps bandit from 1.7.4 to 1.7.7.

Release notes

Sourced from bandit's releases.

1.7.7

What's Changed

• Add the new release to bandit versions of bug template by @​ericwb in PyCQA/bandit#1075
• Bump actions/setup-python from 4 to 5 by @​dependabot in PyCQA/bandit#1076
• Handle variant in how policy is passed in paramiko by @​ericwb in PyCQA/bandit#1078
• Flag str.replace as possible sql injection by @​costaparas in PyCQA/bandit#1044
• defusedxml: Show correct module name by @​kajinamit in PyCQA/bandit#1081
• Add tidelift to the sponsor funding list by @​ericwb in PyCQA/bandit#1089
• Create a security policy by @​ericwb in PyCQA/bandit#1091
• Fix up issues found running Bandit on itself by @​ericwb in PyCQA/bandit#1093
• Add random.randbytes to blacklist calls by @​ericwb in PyCQA/bandit#1096
• Prepend ./ for files specified as CLI args by @​ericwb in PyCQA/bandit#1094
• Rework GitPython dependency to be an extra for bandit-baseline by @​ericwb in PyCQA/bandit#1099
• Bump actions/dependency-review-action from 3 to 4 by @​dependabot in PyCQA/bandit#1101
• Introduce Official Bandit Images by @​lukehinds in PyCQA/bandit#1088
• Remove markdown formatting in reStructuredText formatted README by @​ericwb in PyCQA/bandit#1103
• Downsize the org:repo name by @​lukehinds in PyCQA/bandit#1104

New Contributors

• @​kajinamit made their first contribution in PyCQA/bandit#1081

Full Changelog: https://github.com/PyCQA/bandit/compare/1.7.6...1.7.7

1.7.6

What's Changed

• Update bug report to include version 1.7.5 by @​ericwb in PyCQA/bandit#993
• Render Python 3.10 in drop down correctly by @​ericwb in PyCQA/bandit#997
• Remove checks for Python2 urllib by @​ericwb in PyCQA/bandit#999
• Improper detection of non-requests module by @​ericwb in PyCQA/bandit#1011
• xmlrpclib replaced with xmlrpc in Python3 by @​ericwb in PyCQA/bandit#1012
• language and linting updates by @​marksmayo in PyCQA/bandit#1015
• Adds check for crypt module usage as weak hash by @​ericwb in PyCQA/bandit#1018
• Switch to tox 4 by @​mportesdev in PyCQA/bandit#1020
• Skip unnecessary pip install commands in the pythonpackage.yml workflow by @​mportesdev in PyCQA/bandit#1021
• Update versions of used GitHub Actions by @​mportesdev in PyCQA/bandit#1024
• Update pre-commit hooks by @​mportesdev in PyCQA/bandit#1026
• Add random.Random to B311 checks by @​shiftinv in PyCQA/bandit#940
• Add a copy button to all code snippets in docs by @​ericwb in PyCQA/bandit#1030
• Replace pbr in favor of importlib by @​ericwb in PyCQA/bandit#1016
• Switch from open collective to PSF by @​ericwb in PyCQA/bandit#1031
• Make pre-commit run Bandit hook using a single process by @​Klavionik in PyCQA/bandit#1029
• Remove support for Python 3.7 due to end-of-life by @​ericwb in PyCQA/bandit#1034
• Update asserts.py documentation by @​deronnax in PyCQA/bandit#1036
• Simplify wrap_file_object by @​mportesdev in PyCQA/bandit#1037
• django_rawsql_used: support keyword arguments used in RawSQL by @​kevinmarsh in PyCQA/bandit#765
• Avoid gitpyhon CVE-2022-24439 by @​carlosduelo in PyCQA/bandit#1048
• Update blacklist call documentation by @​costaparas in PyCQA/bandit#1045
• Support ignoring blacklists by name by @​costaparas in PyCQA/bandit#1046
• Fix dependabot to update github actions by @​ericwb in PyCQA/bandit#1057
• Bump actions/checkout from 3 to 4 by @​dependabot in PyCQA/bandit#1058

... (truncated)

Commits

• 4c5b3c8 Downsize the org:repo name (#1104)
• 3f86e84 Remove markdown formatting in reStructuredText formatted README (#1103)
• ff7ed4b Introduce Official Bandit Images (#1088)
• 99ddf6b Bump actions/dependency-review-action from 3 to 4 (#1101)
• 22c75a8 Rework GitPython dependency to be an extra for bandit-baseline (#1099)
• 12e14f6 Prepend ./ for files specified as CLI args (#1094)
• 0779eb0 Add random.randbytes to blacklist calls (#1096)
• 7129108 Fix up issues found running Bandit on itself (#1093)
• c2bd6d6 Create a security policy (#1091)
• a78cafe Add tidelift to the sponsor funding list (#1089)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[codecov[bot]]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Comparison is base (a7a3339) 91.91% compared to head (ca9a63b) 91.91%.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #329   +/-   ##
=======================================
  Coverage   91.91%   91.91%           
=======================================
  Files          19       19           
  Lines         297      297           
=======================================
  Hits          273      273           
  Misses         24       24           

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

[dependabot[bot]]

A newer version of bandit exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.