)]}'
{"global-requirements.txt":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"b215952c3532e43bc435d33589504e6cf4ea1d9f","unresolved":false,"context_lines":[{"line_number":195,"context_line":""},{"line_number":196,"context_line":"# Testing tools below, which are typically in test-requires.txt"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"bandit\u003e\u003d0.10.0"},{"line_number":199,"context_line":"bashate\u003e\u003d0.2 # Apache-2.0"},{"line_number":200,"context_line":"cliff-tablib\u003e\u003d1.0"},{"line_number":201,"context_line":"coverage\u003e\u003d3.6"}],"source_content_type":"text/plain","patch_set":1,"id":"9aa53dc9_54a01c43","line":198,"updated":"2015-04-08 18:53:51.000000000","message":"When I brought this up in infra before, folks were pretty insistent on having a pinned version here: ie. bandit\u003d\u003d0.10.0.  This way changes in Bandit (new tests etc) don\u0027t introduce unexpected behavior.","commit_id":"49a512b83977043f0701371fa237ec553403d7fc"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"92d13fffd5b5693055e27052b8b25fa6d23bd7c3","unresolved":false,"context_lines":[{"line_number":195,"context_line":""},{"line_number":196,"context_line":"# Testing tools below, which are typically in test-requires.txt"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"bandit\u003e\u003d0.10.0"},{"line_number":199,"context_line":"bashate\u003e\u003d0.2 # Apache-2.0"},{"line_number":200,"context_line":"cliff-tablib\u003e\u003d1.0"},{"line_number":201,"context_line":"coverage\u003e\u003d3.6"}],"source_content_type":"text/plain","patch_set":1,"id":"9aa53dc9_b402c809","line":198,"in_reply_to":"9aa53dc9_54a01c43","updated":"2015-04-08 18:59:05.000000000","message":"Good point.  I\u0027ll pin it.","commit_id":"49a512b83977043f0701371fa237ec553403d7fc"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"49a478637ef1dfe2cad2a612ab8a535b7e2126fc","unresolved":false,"context_lines":[{"line_number":196,"context_line":""},{"line_number":197,"context_line":"# Testing tools below, which are typically in test-requires.txt"},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"bandit\u003d\u003d0.10.1"},{"line_number":200,"context_line":"bashate\u003e\u003d0.2 # Apache-2.0"},{"line_number":201,"context_line":"cliff-tablib\u003e\u003d1.0"},{"line_number":202,"context_line":"coverage\u003e\u003d3.6"}],"source_content_type":"text/plain","patch_set":3,"id":"bab921fb_c5c4b941","line":199,"updated":"2015-04-23 15:57:48.000000000","message":"I\u0027m concerned about this being a pin, what\u0027s bandit\u0027s compatibility story","commit_id":"f8ba2972d7f7c74d76eeb5fae8b7b78c380a412e"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"37e84defe35dbf717438ba8cb83ac4f084dbd8e1","unresolved":false,"context_lines":[{"line_number":196,"context_line":""},{"line_number":197,"context_line":"# Testing tools below, which are typically in test-requires.txt"},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"bandit\u003d\u003d0.10.1"},{"line_number":200,"context_line":"bashate\u003e\u003d0.2 # Apache-2.0"},{"line_number":201,"context_line":"cliff-tablib\u003e\u003d1.0"},{"line_number":202,"context_line":"coverage\u003e\u003d3.6"}],"source_content_type":"text/plain","patch_set":3,"id":"bab921fb_00429f3e","line":199,"in_reply_to":"bab921fb_c5c4b941","updated":"2015-04-23 16:08:19.000000000","message":"It was added as a pin so that any new version of Bandit uploaded to PyPi doesn\u0027t break projects due to it adding more security checks (or changing an exist check).   \n\nOtherwise, everyone who uses Bandit will need to maintain a white-list of approved security checks so that newly introduced ones don\u0027t break them.","commit_id":"f8ba2972d7f7c74d76eeb5fae8b7b78c380a412e"},{"author":{"_account_id":4190,"name":"lifeless","email":"robertc@robertcollins.net","username":"lifeless"},"change_message_id":"73fc280401634f8d2058691742ae65fd38d47b24","unresolved":false,"context_lines":[{"line_number":269,"context_line":"# only be updated during the first milestone window of a release,"},{"line_number":270,"context_line":"# because they are way too disruptive beyond that. Ideally nothing"},{"line_number":271,"context_line":"# beyond this list would ever use a \u003d\u003d"},{"line_number":272,"context_line":"bandit\u003d\u003d0.10.1"},{"line_number":273,"context_line":"flake8\u003d\u003d2.2.4"},{"line_number":274,"context_line":"hacking\u003e\u003d0.10.0,\u003c0.11"},{"line_number":275,"context_line":"mccabe\u003d\u003d0.2.1 # MIT License"}],"source_content_type":"text/plain","patch_set":4,"id":"3acd31a7_b679e7fe","line":272,"updated":"2015-04-30 21:26:57.000000000","message":"Are you saying bandit isn\u0027t going to have backwards compatibility? It looks like bandit is part API and part CLI.\n\nIf bandit like e.g. flake8 will immediately make projects fail when it\u0027s version is bumped, then I suppose it needs to be here, but it would be nice if it was less disruptive to work with somehow.","commit_id":"87a0ace9bc788a12da9ff22dceffd737d9627725"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"0369e42e800378742637f0172a7205c0d0a67523","unresolved":false,"context_lines":[{"line_number":269,"context_line":"# only be updated during the first milestone window of a release,"},{"line_number":270,"context_line":"# because they are way too disruptive beyond that. Ideally nothing"},{"line_number":271,"context_line":"# beyond this list would ever use a \u003d\u003d"},{"line_number":272,"context_line":"bandit\u003d\u003d0.10.1"},{"line_number":273,"context_line":"flake8\u003d\u003d2.2.4"},{"line_number":274,"context_line":"hacking\u003e\u003d0.10.0,\u003c0.11"},{"line_number":275,"context_line":"mccabe\u003d\u003d0.2.1 # MIT License"}],"source_content_type":"text/plain","patch_set":4,"id":"3acd31a7_835fb640","line":272,"in_reply_to":"3acd31a7_03ef2688","updated":"2015-05-01 21:11:40.000000000","message":"Ok, I\u0027ll make the change","commit_id":"87a0ace9bc788a12da9ff22dceffd737d9627725"},{"author":{"_account_id":4190,"name":"lifeless","email":"robertc@robertcollins.net","username":"lifeless"},"change_message_id":"1776b2c62705cfd50acb10c35c1b7ffa9eb54851","unresolved":false,"context_lines":[{"line_number":269,"context_line":"# only be updated during the first milestone window of a release,"},{"line_number":270,"context_line":"# because they are way too disruptive beyond that. Ideally nothing"},{"line_number":271,"context_line":"# beyond this list would ever use a \u003d\u003d"},{"line_number":272,"context_line":"bandit\u003d\u003d0.10.1"},{"line_number":273,"context_line":"flake8\u003d\u003d2.2.4"},{"line_number":274,"context_line":"hacking\u003e\u003d0.10.0,\u003c0.11"},{"line_number":275,"context_line":"mccabe\u003d\u003d0.2.1 # MIT License"}],"source_content_type":"text/plain","patch_set":4,"id":"3acd31a7_961b841b","line":272,"in_reply_to":"3acd31a7_1652db67","updated":"2015-05-01 04:03:16.000000000","message":"Ok, so I don\u0027t mean to sidetrack this review, but perhaps in a future iteration of bandit you could do something more graceful.\n\nFor instance, taking a leaf from debhelper:\n - define a bandit-version (read from tox.ini or wherever you store config)\n - make all new checks, power-ups on existing checks consult bandit-version.\n   If the user configured version is \u003c the version the check was added or enhanced in, then warn rather than error.\n\nThat would let projects run with latest bandit, fix issues and upgrade their version as they eliminate particular warnings, without needing a super coordinated thing like this will require.","commit_id":"87a0ace9bc788a12da9ff22dceffd737d9627725"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"23b49d6387f8519f41e8094ecb947e50bc0e9926","unresolved":false,"context_lines":[{"line_number":269,"context_line":"# only be updated during the first milestone window of a release,"},{"line_number":270,"context_line":"# because they are way too disruptive beyond that. Ideally nothing"},{"line_number":271,"context_line":"# beyond this list would ever use a \u003d\u003d"},{"line_number":272,"context_line":"bandit\u003d\u003d0.10.1"},{"line_number":273,"context_line":"flake8\u003d\u003d2.2.4"},{"line_number":274,"context_line":"hacking\u003e\u003d0.10.0,\u003c0.11"},{"line_number":275,"context_line":"mccabe\u003d\u003d0.2.1 # MIT License"}],"source_content_type":"text/plain","patch_set":4,"id":"3acd31a7_a85a9128","line":272,"in_reply_to":"3acd31a7_961b841b","updated":"2015-05-01 19:59:28.000000000","message":"IMO a version pin should actually not be required.  Each project that is using Bandit maintains a configuration file that they use with it.  This configuration file explicitly lists which tests should be run.  \n\nWhen a new version of Bandit which contains new tests is released, these tests will not be picked up automatically in gate tests unless the projects explicitly update their profiles as well.\n\nWe should be fine with simply listing \"bandit\".","commit_id":"87a0ace9bc788a12da9ff22dceffd737d9627725"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"bb8a935499d5846eee959942cba8e59045e8582f","unresolved":false,"context_lines":[{"line_number":269,"context_line":"# only be updated during the first milestone window of a release,"},{"line_number":270,"context_line":"# because they are way too disruptive beyond that. Ideally nothing"},{"line_number":271,"context_line":"# beyond this list would ever use a \u003d\u003d"},{"line_number":272,"context_line":"bandit\u003d\u003d0.10.1"},{"line_number":273,"context_line":"flake8\u003d\u003d2.2.4"},{"line_number":274,"context_line":"hacking\u003e\u003d0.10.0,\u003c0.11"},{"line_number":275,"context_line":"mccabe\u003d\u003d0.2.1 # MIT License"}],"source_content_type":"text/plain","patch_set":4,"id":"3acd31a7_03ef2688","line":272,"in_reply_to":"3acd31a7_a85a9128","updated":"2015-05-01 21:04:33.000000000","message":"Cool, so maybe just \"bandit\" here?","commit_id":"87a0ace9bc788a12da9ff22dceffd737d9627725"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"a28ea7facbbc8560306d4c211e6b8bfff3d3decf","unresolved":false,"context_lines":[{"line_number":269,"context_line":"# only be updated during the first milestone window of a release,"},{"line_number":270,"context_line":"# because they are way too disruptive beyond that. Ideally nothing"},{"line_number":271,"context_line":"# beyond this list would ever use a \u003d\u003d"},{"line_number":272,"context_line":"bandit\u003d\u003d0.10.1"},{"line_number":273,"context_line":"flake8\u003d\u003d2.2.4"},{"line_number":274,"context_line":"hacking\u003e\u003d0.10.0,\u003c0.11"},{"line_number":275,"context_line":"mccabe\u003d\u003d0.2.1 # MIT License"}],"source_content_type":"text/plain","patch_set":4,"id":"3acd31a7_1652db67","line":272,"in_reply_to":"3acd31a7_b679e7fe","updated":"2015-04-30 21:29:58.000000000","message":"The same question has come up from several reviewers.  Yes, if the version is bumped it has the potential to fail projects.  So pinning it makes it less disruptive.","commit_id":"87a0ace9bc788a12da9ff22dceffd737d9627725"}]}