Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
######### Bumplus #########
.. image:: https://github.com/dochang/bumplus/actions/workflows/ci.yml/badge.svg :target: https://github.com/dochang/bumplus/actions/workflows/ci.yml :alt: CI
.. image:: https://dl.circleci.com/status-badge/img/gh/dochang/bumplus/tree/master.svg?style=svg :target: https://dl.circleci.com/status-badge/redirect/gh/dochang/bumplus/tree/master
.. image:: https://codecov.io/gh/dochang/bumplus/branch/master/graph/badge.svg :target: https://codecov.io/gh/dochang/bumplus :alt: Codecov
.. image:: https://img.shields.io/pypi/l/bumplus.svg :alt: PyPI - License :target: https://pypi.python.org/pypi/bumplus
.. image:: https://img.shields.io/pypi/wheel/bumplus.svg :alt: PyPI - Wheel :target: https://pypi.python.org/pypi/bumplus
.. image:: https://img.shields.io/pypi/format/bumplus.svg :alt: PyPI - Format :target: https://pypi.python.org/pypi/bumplus
.. image:: https://img.shields.io/pypi/pyversions/bumplus.svg :alt: PyPI - Python Version :target: https://pypi.python.org/pypi/bumplus
.. image:: https://badge.fury.io/py/bumplus.svg :target: https://badge.fury.io/py/bumplus
.. image:: https://requires.io/github/dochang/bumplus/requirements.svg?branch=master :target: https://requires.io/github/dochang/bumplus/requirements/?branch=master :alt: Requirements Status
.. image:: https://pyup.io/repos/github/dochang/bumplus/shield.svg :target: https://pyup.io/repos/github/dochang/bumplus/ :alt: Updates
.. image:: https://pyup.io/repos/github/dochang/bumplus/python-3-shield.svg :target: https://pyup.io/repos/github/dochang/bumplus/ :alt: Python 3
.. image:: https://img.shields.io/badge/say-thanks-green.svg :target: https://saythanks.io/to/dochang :alt: Say Thanks!
Bumplus is a command line tool to bump your project version.
Prerequisites
Python 3.8, 3.9, 3.10, 3.11, 3.12
Installation
.. code::
pip install bumplus
Usage
Put a TOML_ file named .bumplus.toml
in the top-level directory of
your project. This file at least contains the following content:
.. code::
version = "<current_version>"
See Configuration_ for more config options.
.. _toml: https://github.com/toml-lang/toml
.. code::
cd bumplus <new_version>
Use bumplus --help
to display the help text.
.. code::
import bumplus bp = bumplus.Bumplus('') bp.bump_version('<new_version>')
Example of .bumplus.toml
.. code::
version = '1.2.3'
[[files."CHANGELOG.md"]] search = '''
''' replace = '''
'''
[[files."CHANGELOG.md"]] search = ''' http://host/changelog/{{old_version}}.html ''' search = ''' http://host/changelog/{{new_version}}.html http://host/changelog/{{old_version}}.html '''
[[files."LICENSE"]] search = '{{old_version}}' replace = '{{new_version}}'
[[files."src/version.py"]] search = '{{old_version}}' replace = '{{new_version}}'
Configuration
A string that is the current version.
A table which configures all files need to be modified.
Every key is a relative path name. The value of a key is an array of
replacement config. Every item of an array is an object which has two
keys: search
and replace
. The value of search
is the pattern to be
replaced. The value of replace
is the new text after replacing.
The contents of search
and replace
are Jinja2_ templates. Several
predefined variables can be used in the templates:
old_version
new_version
now
utcnow
now
and utcnow
are Python datetime
objects.
The Jinja2 templates also support a custom filter strftime
, which is
used to format time such as now
and utcnow
. The format string is the
same as the parameter of strftime
method of Python datetime
object.
.. _jinja2: http://jinja.pocoo.org/
.. attention::
Bumplus always replaces the current version in .bumplus.toml
after
processing all files in the configuration.
License
MIT <https://dochang.mit-license.org/>
_
FAQs
Bump the version in the project files.
We found that bumplus demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.