Skip to content

v0.1.1

Choose a tag to compare

View all tags
@ImalkaPerera ImalkaPerera released this 18 Oct 00:48
· 94 commits to main since this release
v0.1.1
f49e309

Security

git blame in --with-git could run a program named in the scanned repository's own .git/config (a textconv driver). Scanning an untrusted repository with --with-git on 0.1.0 could therefore run code on your machine. 0.1.1 runs git blame with --no-textconv. If you scan code you do not trust with --with-git, upgrade to 0.1.1. See the security advisory for details.

Fixes

  • Git evidence ignores GIT_DIR and related variables inherited from the environment, so running from a git hook no longer reads another repository.
  • A .deviant/config.json that is a symlink or over 1 MB is ignored.
  • GitHub Actions: a job whose name repeats an earlier nested key (such as a matrix variable) is reported on its own line.

Improvements

  • FastAPI: routers stored on self inside a class are followed.
  • FastAPI: a helper name counts as an auth check only if every function with that name checks credentials.

Other

  • Licensed under MIT or Apache-2.0, at your option.
  • Deviant's own CI and release jobs now have timeouts.
Assets 2
Loading