chore(deps-dev): update ruff requirement from <0.13,>=0.12 to >=0.12,<0.17 - #1
Closed
dependabot[bot] wants to merge 10 commits into
Closed
chore(deps-dev): update ruff requirement from <0.13,>=0.12 to >=0.12,<0.17#1dependabot[bot] wants to merge 10 commits into
dependabot[bot] wants to merge 10 commits into
Conversation
- pyproject: license MIT → MIT-0(与 LICENSE 文件一致,消除声明矛盾); authors Neo → Amazon.com, Inc. or its affiliates; package name → sample-quick-control - docs/*.svg: 图标题 amazon-quick-control → sample-quick-control - 保留 ~/.claude/skills/amazon-quick-control(Claude skill 标识符,非仓名) 门禁结果:scan_repo rc=0 / audit 0 gap / pytest 79 passed 5 skipped / ruff 全过
Probe 报 Critical=111,分诊结果:**全部来自 semgrep 的同一条规则 arbitrary-sleep**, gitleaks / grype / syft / bandit / cfn_nag / checkov 全部为 0 —— 即无硬编码密钥、无漏洞依赖、无 IaC 高危配置,不存在真实安全问题。 arbitrary-sleep 是代码卫生类规则(建议用事件/条件等待替代裸 sleep)。但对本项目而言 这些 sleep 是**功能必需**:浏览器与桌面应用自动化必须等应用重启、等页面渲染、 等 CDP 响应到达 —— 逐处核对确认,无一处是忙等或可直接删除的。 处理方式遵循 probe-triage 的正解: · 逐行加 `# nosemgrep: arbitrary-sleep -- <具体理由>`(锚点行必须是 finding 报告的那行) · **不**全局禁用规则、**不**改扫描配置、**不**删除有功能的代码 覆盖 9 个文件共 112 处(Probe 报 111,差 1 处在 tests/test_e2e.py,一并抑制)。 验证:全部 .py 语法通过、ruff All checks passed、pytest exit 0(5 个 e2e 因需真实 浏览器而预期 skip)。
PCSR 工单前置清单要求逐条检查 Warning 并写明结论。本次 Probe 扫描 Critical=0,Warning=14(全部来自 bandit),逐条核对结果: ## B108 x10 —— 真实(低危),已修 硬编码 `/tmp/quick.png` / `/tmp/quick_screen.json` / `/tmp/quickweb.png` 等 默认输出路径。/tmp 全局可写且路径可预测,多用户机器上他人可预先创建同名文件或 符号链接抢占(symlink attack)—— 会把截图/页面结构写到攻击者可读的位置,或覆盖 其它文件。 本项目是**公开 sample**,客户会照抄这个模式,所以选择**真修而非抑制**: 新增 `_out_dir()` / `_out(name)`,默认落到 `~/.cache/quick-control`(创建时 mode=0o700,实测生效),可用环境变量 QUICK_OUT_DIR 覆盖。 命令行接口未变 —— 仍可显式传路径。共替换 10 处,涉及 6 个脚本。 ## B310 x4 —— 误报,不修 `urllib.request.urlopen` 的 4 处调用全部指向**硬编码的 127.0.0.1 本地 CDP 端点** (`http://127.0.0.1:{PORT}/json/...`),协议固定 http、无任何用户输入参与 URL 拼接。 该规则担心的是 `file:/` 或自定义 schema 被意外允许,此处不存在这种可能。 保留原样,并已在工单中逐条说明理由。 验证:全部 .py 语法通过;ruff All checks passed(顺带修掉注入 import os 时 在 `import sys, os, json` 这类单行多模块导入上产生的 5 处 F811 重复导入); pytest exit 0(5 个 e2e 因需真实浏览器而预期 skip); helper 实测返回 ~/.cache/quick-control 且目录权限 0o700。
…official governance files
Updates the requirements on [ruff](https://github.com/astral-sh/ruff) to permit the latest version. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.12.0...0.16.2) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.16.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
neosun100
force-pushed
the
dependabot/pip/ruff-gte-0.12-and-lt-0.17
branch
from
August 13, 2026 06:09
2c84bc7 to
f611a5b
Compare
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the requirements on ruff to permit the latest version.
Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
... (truncated)
Commits
5b48a04Bump 0.16.2 (#27555)1b9e5fcUpdate Swatinem/rust-cache action to v2.9.2 (#27568)c4e86fc[ty] Add helper extension methods for half-range and equality constraints (#2...17a00de[ty] Reuse primer commands in memory reports (#27553)6ea296b[ty] Normalize type labels in structured docstrings (#26923)2fc445f[ty] Diagnose invalid getattr calls (#27502)22c7823[ty] Enable (but downrank) auto-import completion suggestions from stub-only ...05160d5[ty] Diagnose invalid descriptor__get__calls (#27400)baea3d0[ty] Expose strict analysis options in the playground (#27543)c88946e[ty] Bump ecosystem-analyzer for strict project settings (#27542)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)