Skip to content

v0.3.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Aug 18:37
· 36 commits to main since this release
v0.3.1
6beca30

v0.3.1 (2026-08-21)

This release is published under the MIT License.

Bug Fixes

  • github: Tell bandit the token-command constants hold no token (2abb09e)

B105 reads any name carrying "token" as a credential, so TOKEN_COMMAND_ENV and DEFAULT_TOKEN_COMMAND were reported as hardcoded passwords. One holds the name of an environment variable and the other the text of a command.

bandit runs in a custom block of validate.yml and had no local counterpart, so the finding could only surface as a red push. The pre-commit hook runs the same command against the same config, which is what keeps the two from disagreeing.

Detailed Changes: v0.3.0...v0.3.1

Assets 2
Loading