pyproject.toml

[project]
name = "vulnlist"
requires-python = ">=3.9.0"

[tool.poetry.scripts]
vulnlist = "vulnlist.cli:run"

[tool.poetry]
name = "vulnlist"
version = "0.0.0" # note: this is automagically managed -- no need to manually change this
description = "vulnlist ~= 'vulnerability data funnel'"
authors = ["KhulnaSoft Security <security@khulnasoft.com>"]
license = "Apache-2.0"
readme = "README.md"
repository = "https://github.com/khulnasoft-lab/vulnlist"
exclude = [
  "tests/**/*"
]
keywords = [
  "vulnerability",
  "data",
  "aggregator",
  "grype",
  "vulnerability-data",
]

classifiers = [
  # derived from https://pypi.org/classifiers/
  "Development Status :: 5 - Production/Stable",
  "Intended Audience :: Developers",
  "Intended Audience :: Information Technology",
  "Intended Audience :: System Administrators",
  "Natural Language :: English",
  "Operating System :: POSIX :: Linux",
  "Operating System :: MacOS",
  "Topic :: Security",
  "Topic :: Software Development :: Libraries :: Python Modules",
  "Topic :: Utilities",
]

[tool.poetry.dependencies]
python = "^3.9"

click = "^8.1.3"
requests = "^2.28.1"
colorlog = "^6.7.0"
PyYAML = ">= 6.0, < 7.0"  # note: required for enterprise
ijson = ">=2.5.1,<4.0"   # note: required for enterprise
xxhash = "^3.1.0"
cvss = ">=2.6,<4.0"
python-dateutil = "^2.8.2"
defusedxml = "^0.7.1"
orjson = "^3.8.6"
SQLAlchemy = ">= 1.4.46, < 2.0"  # note: 1.4.x currently required for enterprise
mergedeep = "^1.3.4"
importlib-metadata = "^7.0.1"
xsdata = {extras = ["cli", "lxml", "soap"], version = ">=22.12,<25.0"}
pytest-snapshot = "^0.9.0"
mashumaro = "^3.10"
iso8601 = "^2.1.0"
zstandard = "^0.22.0"

[tool.poetry.group.dev.dependencies]
pytest = ">=7.2.2,<9.0.0"
pre-commit = "^3.2.0"
black = ">=23.1,<25.0"
jsonschema = "^4.17.3"
pytest-unordered = ">=0.5.2,<0.7.0"
pytest-sugar = ">=0.9.6,<1.1.0"
pytest-clarity = "^1.0.1"
pytest-cov = ">=4,<6"
pytest-picked = ">=0.4.6,<0.6.0"
pytest-mock = "^3.10.0"
pytest-xdist = "^3.2.1"
types-PyYAML = "^6.0.12.5"
types-requests = "^2.28.11.7"
mypy = "^1.1"
radon = ">=5.1,<7.0"
dunamai = "^1.15.0"
ruff = ">=0.4.9,<0.5.0"
vulnstick = {git = "https://github.com/khulnasoft-lab/vulnstick", rev = "v0.9.2"}
tabulate = "0.9.0"
tox = "^4.11.3"

[build-system]
requires = ["poetry-core>=1.3.0", "poetry-dynamic-versioning"]
# note: this is a thin wrapper around "poetry.core.masonry.api"
build-backend = "poetry_dynamic_versioning.backend"

[tool.pytest.ini_options]
cache_dir = ".cache/pytest"

[tool.mypy]
cache_dir = ".cache/mypy"
follow_imports = "silent"
strict_optional = true
warn_redundant_casts = true
warn_unused_ignores = true
disallow_any_generics = true
check_untyped_defs = true
no_implicit_reexport = true
disallow_untyped_defs = true
ignore_missing_imports = true
exclude = '''(?x)(
    ^src/vulnlist/providers/alpine/parser\.py$      # ported from enterprise, never had type hints
    | ^src/vulnlist/providers/amazon/parser\.py$    # ported from enterprise, never had type hints
    | ^src/vulnlist/providers/debian/parser\.py$    # ported from enterprise, never had type hints
    | ^src/vulnlist/providers/github/parser\.py$    # ported from enterprise, never had type hints
    | ^src/vulnlist/providers/mariner/model/        # generated code
    | ^src/vulnlist/providers/nvd/parser\.py$       # ported from enterprise, never had type hints
    | ^src/vulnlist/providers/oracle/parser\.py$    # ported from enterprise, never had type hints
    | ^src/vulnlist/providers/rhel/parser\.py$      # ported from enterprise, never had type hints
    | ^src/vulnlist/providers/rhel/oval_parser\.py$      # ported from enterprise, never had type hints
    | ^src/vulnlist/providers/sles/parser\.py$      # ported from enterprise, never had type hints
    | ^src/vulnlist/providers/ubuntu/git\.py$       # ported from enterprise, never had type hints
    | ^src/vulnlist/providers/ubuntu/parser\.py$    # ported from enterprise, never had type hints
    | ^src/vulnlist/providers/wolfi/parser\.py$     # ported from enterprise, never had type hints
    | ^src/vulnlist/utils/oval_v2.py$               # ported from enterprise, never had type hints
    | ^src/vulnlist/utils/oval_parser.py$           # ported from enterprise, never had type hints
    | ^src/vulnlist/utils/fdb.py$                   # ported from enterprise, never had type hints
    | ^src/vulnlist/utils/vulnerability.py$         # ported from enterprise, never had type hints
    | ^tests/.*$     # any tests
)'''

[tool.black]
line-length = 130
exclude = '''
(
  /(
      \.eggs         # exclude a few common directories in the
    | \.git          # root of the project
    | \.hg
    | \.mypy_cache
    | \.tox
    | \.venv
    | _build
    | buck-out
    | build
    | dist
    | data
    | backup
    | src/vulnlist/providers/mariner/model # files in here are generated
    | tests/quality/vulnerability-match-labels
    | tests/quality/.vulnstick
    | tests/quality/data
    | tests/quality/build
    | tests/quality/bin
  )/
)
'''

[tool.coverage.run]
omit = [
  ".*",
  "*/site-packages/*",
  "*/venv/*",
  "tests/*",
  "src/vulnlist/__main__.py",
  "src/vulnlist/cli/__init__.py",
]

[tool.coverage.report]
fail_under = 75

[tool.poetry-dynamic-versioning]
enable = true
vcs = "git"
metadata = false
style = "semver"
dirty = true

[tool.ruff]
cache-dir = ".cache/ruff"
# allow for a wide-birth relative to what black will correct to
line-length = 150

extend-exclude = [
  "**/tests/**",
  "src/vulnlist/providers/mariner/model/**" # these are generated
]

[tool.ruff.lint]
ignore = [
  "ARG001", # unused args are ok, as they communicate intent in interfaces, even if not used in impls.
  "ARG002", # unused args are ok, as they communicate intent in interfaces, even if not used in impls.
  "G004", # it's ok to use formatted strings for logging
  "PGH004", # no blanked "noqa" usage, can be improved over time, but not now
  "PLR2004", # a little too agressive, not allowing any magic numbers
  "PLW2901", # "Outer for loop variable X overwritten by inner assignment target", not useful in most cases
  "RUF100", # no blanket "noqa" usage, can be improved over time, but not now
  "UP038", # Use `X | Y` in `isinstance` call instead of `(X, Y)` -- not compatible with python 3.9 (even with __future__ import)
]

select = [
  "A",   # flake8-builtins
  # "ANN", # flake8-annotations   # this is great, but let mypy handle this so it can honor type:ignore comments without noqa comments too
  "ARG", # flake8-unused-arguments
  "B",   # flake8-bugbear
  "C",   # mccabe
  "C4",  # flake8-comprehensions
  "COM", # flake8-commas
  "DTZ", # flake8-datetimez
  "E",   # pycodestyle, errors
  # "EM",  # flake8-errmsg     # seems to aggressive relative to the current codebase
  # "ERA", # flake8-eradicate  # not all code in comments should be removed
  "EXE", # flake8-executable
  "F",   # pyflakes
  "G",   # flake8-logging-format
  "I",   # isort
  "ICN", # flake8-import-conventions
  "INP", # flake8-no-pep420
  "ISC", # flake8-implicit-str-concat
  "PGH", # pygrep-hooks
  "PIE", # flake8-pie
  "PL",  # pylint     (this can be broken down into more checks if needed)
  "PT",  # flake8-pytest-style
  # "PTH", # flake8-use-pathlib  # the codebase is not ready for this yet, but would be nice to add
  "Q",   # flake8-quotes
  "RET", # flake8-return
  "RSE", # flake8-raise
  "RUF", # ruff specific rules
  "S",   # flake8-bandit
  "SIM", # flake8-simplify
  "SLF", # flakes8-self
  "T10", # flake8-debugger
  "TCH", # flake8-type-checking
  "TID", # flake8-tidy-imports
  # "TRY", # tryceratops   # seems to aggressive relative to the current codebase
  "UP",  # pyupgrade
  "W",   # pycodestyle, warnings
  "YTT", # flake8-2020
]

[tool.ruff.lint.flake8-tidy-imports.banned-api]
"json.dump".msg = "Use orjson.dumps instead"
"json.dumps".msg = "Use orjson.dumps instead"
"json.load".msg = "Use orjson.loads instead"
"json.loads".msg = "Use orjson.loads instead"