ramstk build: bump bandit from 1.7.5 to 1.7.8

Bumps bandit from 1.7.5 to 1.7.8.

Release notes

1.7.8

What's Changed

Incorrect tag naming in readme by @lukehinds in PyCQA/bandit#1105

Utilize PyPI's trusted publishing by @ericwb in PyCQA/bandit#1107

Bump sigstore/cosign-installer from 3.3.0 to 3.4.0 by @dependabot in PyCQA/bandit#1109

Add 1.7.7 to versions of bug template by @ericwb in PyCQA/bandit#1110

Use datetime to avoid updating copyright year by @ericwb in PyCQA/bandit#1112

filter data is safe for tarfile extractall by @etienneschalk in PyCQA/bandit#1111

Bump docker/setup-buildx-action from 3.0.0 to 3.1.0 by @dependabot in PyCQA/bandit#1115

[B605] Add functions that are vulnerable to shell injection. by @shihai1991 in PyCQA/bandit#1116

Add a SARIF output formatter by @ericwb in PyCQA/bandit#1113

New Contributors

@etienneschalk made their first contribution in PyCQA/bandit#1111

@shihai1991 made their first contribution in PyCQA/bandit#1116

Full Changelog: https://github.com/PyCQA/bandit/compare/1.7.7...1.7.8

1.7.7

What's Changed

Add the new release to bandit versions of bug template by @ericwb in PyCQA/bandit#1075

Bump actions/setup-python from 4 to 5 by @dependabot in PyCQA/bandit#1076

Handle variant in how policy is passed in paramiko by @ericwb in PyCQA/bandit#1078

Flag str.replace as possible sql injection by @costaparas in PyCQA/bandit#1044

defusedxml: Show correct module name by @kajinamit in PyCQA/bandit#1081

Add tidelift to the sponsor funding list by @ericwb in PyCQA/bandit#1089

Create a security policy by @ericwb in PyCQA/bandit#1091

Fix up issues found running Bandit on itself by @ericwb in PyCQA/bandit#1093

Add random.randbytes to blacklist calls by @ericwb in PyCQA/bandit#1096

Prepend ./ for files specified as CLI args by @ericwb in PyCQA/bandit#1094

Rework GitPython dependency to be an extra for bandit-baseline by @ericwb in PyCQA/bandit#1099

Bump actions/dependency-review-action from 3 to 4 by @dependabot in PyCQA/bandit#1101

Introduce Official Bandit Images by @lukehinds in PyCQA/bandit#1088

Remove markdown formatting in reStructuredText formatted README by @ericwb in PyCQA/bandit#1103

Downsize the org:repo name by @lukehinds in PyCQA/bandit#1104

New Contributors

@kajinamit made their first contribution in PyCQA/bandit#1081

Full Changelog: https://github.com/PyCQA/bandit/compare/1.7.6...1.7.7

1.7.6

What's Changed

Update bug report to include version 1.7.5 by @ericwb in PyCQA/bandit#993

Render Python 3.10 in drop down correctly by @ericwb in PyCQA/bandit#997

Remove checks for Python2 urllib by @ericwb in PyCQA/bandit#999

Improper detection of non-requests module by @ericwb in PyCQA/bandit#1011

xmlrpclib replaced with xmlrpc in Python3 by @ericwb in PyCQA/bandit#1012

language and linting updates by @marksmayo in PyCQA/bandit#1015

Adds check for crypt module usage as weak hash by @ericwb in PyCQA/bandit#1018

... (truncated)

Commits

22b4226 Add a SARIF output formatter (#1113)
b603dce [B605] Add functions that are vulnerable to shell injection. (#1116)
a682a18 Bump docker/setup-buildx-action from 3.0.0 to 3.1.0 (#1115)
c8d5f77 filter data is safe for tarfile extractall (#1111)
e041e12 Use datetime to avoid updating copyright year (#1112)
5b16b6a Add 1.7.7 to versions of bug template (#1110)
858bfd8 Bump sigstore/cosign-installer from 3.3.0 to 3.4.0 (#1109)
be5d6ac Utilize PyPI's trusted publishing (#1107)
c3a07e5 Incorrect tag naming in readme (#1105)
4c5b3c8 Downsize the org:repo name (#1104)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Mar 11 '24 10:03 dependabot[bot]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

Mar 11 '24 10:03 sonarqubecloud[bot]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 96.87%. Comparing base (ec57e57) to head (7932ced). Report is 5 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1377      +/-   ##
==========================================
- Coverage   96.88%   96.87%   -0.02%     
==========================================
  Files         157      157              
  Lines        5529     5529              
  Branches      491      491              
==========================================
- Hits         5357     5356       -1     
  Misses        147      147              
- Partials       25       26       +1

Flag	Coverage Δ
3.10	`96.86% <ø> (-0.02%)`	:arrow_down:
3.8	`96.87% <ø> (ø)`
3.9	`96.87% <ø> (-0.02%)`	:arrow_down:

Flags with carried forward coverage won't be shown. Click here to find out more.

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

Mar 11 '24 10:03 codecov[bot]

Superseded by #1384.

Aug 12 '24 10:08 dependabot[bot]