Conversation
…/python-semantic-release/python-semantic-release-10.6.1 fix(deps): bump python-semantic-release/python-semantic-release from 10.5.3 to 10.6.1
Bumps [actions/stale](https://github.com/actions/stale) from 10.3.0 to 10.4.0. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@eb5cf3a...1e223db) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 10.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…2290) * fix(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.0 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.2 to 4.37.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...99df26d) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * fix: codeql-action/init v4.37.0 Signed-off-by: degenaro <lou.degenaro@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: degenaro <lou.degenaro@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: degenaro <lou.degenaro@gmail.com>
) Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.0 to 1.14.1. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@cef2210...ba38be9) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#2294) Bumps [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) from 8.2.0 to 8.2.1. - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](SonarSource/sonarqube-scan-action@7138816...2291811) --- updated-dependencies: - dependency-name: SonarSource/sonarqube-scan-action dependency-version: 8.2.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lou DeGenaro <lou.degenaro@gmail.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@ece7cb0...5fda3b9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lou DeGenaro <lou.degenaro@gmail.com>
…2295) * fix(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.3 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.0 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@99df26d...e4fba86) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * fix: merge init v4.37.3 Signed-off-by: degenaro <lou.degenaro@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: degenaro <lou.degenaro@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: degenaro <lou.degenaro@gmail.com>
Signed-off-by: degenaro <lou.degenaro@gmail.com>
Signed-off-by: Matteo Fari <matteofari06@gmail.com> Co-authored-by: Lou DeGenaro <lou.degenaro@gmail.com>
degenaro
force-pushed
the
develop
branch
4 times, most recently
from
August 6, 2026 12:30
2a1a041 to
64cc98c
Compare
* Fix is_ordered_sublist matching substrings across list items is_ordered_sublist joined both lists with spaces and did a substring test, so a needle item could match part of a haystack item (for example ['b'] was reported as contained in ['abc']). Compare the items directly as a contiguous run instead, which matches the documented behavior and the existing examples. Signed-off-by: Arpit Jain <arpitjain099@gmail.com> * fix: satisfy ruff SIM110 in is_ordered_sublist Replaces the explicit scan loop with any(), which is what 'hatch fmt --linter --check' was flagging (SIM110). Behavior is unchanged, including the empty-needle and needle-longer-than-haystack cases. Signed-off-by: Arpit Jain <arpitjain099@gmail.com> * style: apply ruff format to the slice expression Whitespace only. Makes 'ruff format --check' clean for this file as well as the linter. Signed-off-by: Arpit Jain <arpitjain099@gmail.com> --------- Signed-off-by: Arpit Jain <arpitjain099@gmail.com> Co-authored-by: Lou DeGenaro <lou.degenaro@gmail.com> Signed-off-by: Lou DeGenaro <lou.degenaro@gmail.com>
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.3 to 2.4.4. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lou DeGenaro <lou.degenaro@gmail.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lou DeGenaro <lou.degenaro@gmail.com>
…2299) Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 2.4.0 to 4.1.1. - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@e8998f9...0f67c3f) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lou DeGenaro <lou.degenaro@gmail.com>
* fix: correct error path in assemble command Signed-off-by: Rishi Jat <rishijat098@gmail.com> * test: add coverage for assemble missing root model file error Signed-off-by: Rishi Jat <rishijat098@gmail.com> * fix: give consistent error Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: updates to address claude review Signed-off-by: degenaro <lou.degenaro@gmail.com> --------- Signed-off-by: Rishi Jat <rishijat098@gmail.com> Signed-off-by: degenaro <lou.degenaro@gmail.com> Co-authored-by: Lou DeGenaro <lou.degenaro@gmail.com>
* fix: no errors Signed-off-by: degenaro <lou.degenaro@gmail.com> * 447 failed, 940 passed, 4 skipped, 538458 warnings * 403 failed, 984 passed, 4 skipped, 1793 warnings Signed-off-by: degenaro <lou.degenaro@gmail.com> * 366 failed, 1021 passed, 4 skipped, 1826 warnings Signed-off-by: degenaro <lou.degenaro@gmail.com> * 360 failed, 1027 passed, 4 skipped, 1826 warnings Signed-off-by: degenaro <lou.degenaro@gmail.com> * 345 failed, 1042 passed, 4 skipped, 1853 warnings Signed-off-by: degenaro <lou.degenaro@gmail.com> * 285 failed, 1102 passed, 4 skipped, 66 warnings Signed-off-by: degenaro <lou.degenaro@gmail.com> * 285 failed, 1102 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 279 failed, 1108 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 271 failed, 1116 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 260 failed, 1127 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 250 failed, 1137 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 249 failed, 1137 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 248 failed, 1138 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 247 failed, 1139 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 246 failed, 1140 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 245 failed, 1141 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 244 failed, 1142 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 243 failed, 1143 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 242 failed, 1144 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 241 failed, 1145 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 236 failed, 1150 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 231 failed, 1155 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 227 failed, 1159 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 207 failed, 1179 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: format Signed-off-by: degenaro <lou.degenaro@gmail.com> * 200 failed, 1186 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 176 failed, 1210 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 175 failed, 1211 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 171 failed, 1215 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 162 failed, 1224 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 161 failed, 1225 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 158 failed, 1228 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 150 failed, 1241 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 101 failed, 1290 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 83 failed, 1308 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 76 failed, 1315 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 72 failed, 1318 passed, 5 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 67 failed, 1323 passed, 5 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 61 failed, 1329 passed, 5 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 48 failed, 1342 passed, 5 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 46 failed, 1344 passed, 5 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 42 failed, 1348 passed, 5 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 37 failed, 1353 passed, 5 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 21 failed, 1369 passed, 5 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 11 failed, 1379 passed, 5 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 5 failed, 1386 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * 1391 passed, 4 skipped Signed-off-by: degenaro <lou.degenaro@gmail.com> * integrate with canonicalization Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: bdist Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: dist error Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: dmcg issues Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: sonar code duplication complaints Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: improve test coverage Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix sonar complaints: model_utils.py Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix sonar complaints: type_utils.py Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix sonar complaints Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: mypy complaints Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix sonar complaints: complexity Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: sonar complaints complexity Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: mypy complaints Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: sonar complexity complaints Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix sonar complexity complaints Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: sonar complaints Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: Makefile Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: text-cov-xml Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: improve test coverage Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: merge pyproject.toml Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: RiskStatus pydantic v2 root= instead of __root__= * fix: bob review issue #1 Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: bob review issue #2 Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: bob review issue #3 Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: bob review issue #4 Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: bob review issue #5 Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix" bob review issue #6 Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: bob review issue #7 Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: bob review issue #8 Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: bob review issue #9 Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: bob review issue #10 Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: bob review issue #11, #12 Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: bob review issue #13 Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: bob review issue #14 Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: all source code modules test coverage > 92% Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: generators.py should produce OSCAL_VERSION value not REPLACE_ME Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: improve error messages We attempt to give better error messages with respect to pydantic v2 mode and prior versions compatibility with OSCAL 1.2.x. Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: mypy errors Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: test should not accept empty list Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: results empty list allowed for model construction only Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: add missing test cases Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: lower case is requirement for component type per OSCAL schema Signed-off-by: degenaro <lou.degenaro@gmail.com> --------- Signed-off-by: degenaro <lou.degenaro@gmail.com>
* fix: new version updates Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: end of support date for 4.x Signed-off-by: degenaro <lou.degenaro@gmail.com> * fix: readme BREAKING CHANGE: pydantic v2 mode and more Signed-off-by: degenaro <lou.degenaro@gmail.com> --------- Signed-off-by: degenaro <lou.degenaro@gmail.com>
The fix is in trestle/core/catalog/catalog_interface.py:127. What was wrong: group.title is user-controlled data (sourced from a catalog file). Logging it directly is vulnerable to log injection — a malicious title containing newlines (\n, \r) could forge additional log entries or corrupt log output (CWE-117 / SonarQube S5145). What was changed: The user-controlled value is sanitized before logging by: Calling str() to ensure it's a string. Replacing \n and \r with their literal escape sequences, which neutralises any newline-injection attempt. Handling the None case (empty string fallback) to avoid NoneType errors. Signed-off-by: degenaro <lou.degenaro@gmail.com>
Signed-off-by: degenaro <lou.degenaro@gmail.com>
…2309) * fix(deps): bump github/codeql-action/analyze from 4.37.3 to 4.37.4 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.3 to 4.37.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e4fba86...f205ea1) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * fix: merge update for init from separate PR Signed-off-by: degenaro <lou.degenaro@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: degenaro <lou.degenaro@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: degenaro <lou.degenaro@gmail.com>
#2310) Bumps [sigstore/gh-action-sigstore-python](https://github.com/sigstore/gh-action-sigstore-python) from 3.4.0 to 3.5.0. - [Release notes](https://github.com/sigstore/gh-action-sigstore-python/releases) - [Changelog](https://github.com/sigstore/gh-action-sigstore-python/blob/main/CHANGELOG.md) - [Commits](sigstore/gh-action-sigstore-python@5b79a39...790bc6b) --- updated-dependencies: - dependency-name: sigstore/gh-action-sigstore-python dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lou DeGenaro <lou.degenaro@gmail.com>
Bumps [actions/stale](https://github.com/actions/stale) from 10.4.0 to 11.0.0. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@1e223db...4391f3d) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 11.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lou DeGenaro <lou.degenaro@gmail.com>
) Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.1 to 1.14.2. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@ba38be9...dc37677) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lou DeGenaro <lou.degenaro@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Types of changes
develop->main)Quality assurance (all should be covered).
Summary
Key links:
Before you merge