Commits on Jan 21, 2024

1. Rework GitPython dependency to be an extra for bandit-baseline …

   The only piece of code that requires GitPython is bandit-baseline.
   There tends to be an abundance of CVEs in the GitPython library
   due to its dependency on Git. By making GitPython optional via
   an extra, users who mostly use just the bandit command line and
   not bandit-baseline can benefit.
   
   However, this will require different install if a user wants to
   use bandit-baseline. This is now noted in the Getting Started
   doc, but you simply do:
   
   pip install bandit[GitPython]
   
   FYI, this option was suggested in PR PyCQA#976.
   
   PyCQA#976
   
   Signed-off-by: Eric Brown <eric_wade_brown@yahoo.com>

   

   ericwb committed Jan 21, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for a354d7b
   • Browse repository at this point

   Copy the full SHA

   a354d7b View commit details

   Browse the repository at this point in the history