Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Documentation: https://commitizen-tools.github.io/commitizen/
Commitizen is release management tool designed for teams.
Commitizen assumes your team uses a standard way of committing rules and from that foundation, it can bump your project's version, create the changelog, and update files.
By default, commitizen uses conventional commits, but you can build your own set of rules, and publish them.
Using a standardized set of rules to write commits, makes commits easier to read, and enforces writing descriptive commits.
Python 3.9+
Git 1.8.5.2+
Install commitizen in your system using pipx
(Recommended, https://pypa.github.io/pipx/installation/):
pipx ensurepath
pipx install commitizen
pipx upgrade commitizen
Install commitizen using pip
with --user
flag:
pip install --user -U commitizen
You can add it to your local project using one of the following.
With pip
:
pip install -U commitizen
With conda
:
conda install -c conda-forge commitizen
With Poetry >= 1.2.0:
poetry add commitizen --group dev
With Poetry < 1.2.0:
poetry add commitizen --dev
via homebrew:
brew install commitizen
Most of the time this is the only command you'll run:
cz bump
On top of that, you can use commitizen to assist you with the creation of commits:
cz commit
Read more in the section Getting Started.
$ cz --help
usage: cz [-h] [--debug] [-n NAME] [-nr NO_RAISE] {init,commit,c,ls,example,info,schema,bump,changelog,ch,check,version} ...
Commitizen is a cli tool to generate conventional commits.
For more information about the topic go to https://conventionalcommits.org/
optional arguments:
-h, --help show this help message and exit
--config the path of configuration file
--debug use debug mode
-n NAME, --name NAME use the given commitizen (default: cz_conventional_commits)
-nr NO_RAISE, --no-raise NO_RAISE
comma separated error codes that won't rise error, e.g: cz -nr 1,2,3 bump. See codes at https://commitizen-
tools.github.io/commitizen/exit_codes/
commands:
{init,commit,c,ls,example,info,schema,bump,changelog,ch,check,version}
init init commitizen configuration
commit (c) create new commit
ls show available commitizens
example show commit example
info show information about the cz
schema show commit schema
bump bump semantic version based on the git log
changelog (ch) generate changelog (note that it will overwrite existing file)
check validates that a commit message matches the commitizen schema
version get the version of the installed commitizen or the current project (default: installed commitizen)
When using bash as your shell (limited support for zsh, fish, and tcsh is available), Commitizen can use argcomplete for auto-completion. For this argcomplete needs to be enabled.
argcomplete is installed when you install Commitizen since it's a dependency.
If Commitizen is installed globally, global activation can be executed:
sudo activate-global-python-argcomplete
For permanent (but not global) Commitizen activation, use:
register-python-argcomplete cz >> ~/.bashrc
For one-time activation of argcomplete for Commitizen only, use:
eval "$(register-python-argcomplete cz)"
For further information on activation, please visit the argcomplete website.
These are our cool sponsors!
FAQs
Python commitizen client tool
We found that commitizen demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.