Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Requires:
See https://www.conventionalcommits.org/en/v1.0.0/. You can use this git commit message format in many different ways, but the easiest is:
NOTE: You only need hatch if you need to build releases, and you only need commitizen for releases OR to make it easy to follow conventional commits for your commit messages (see Use conventional commits for GIT commit messages above).
First install pipx with:
brew install pipx
pipx ensurepath
Then install hatch and commitizen:
pipx install hatch
pipx install commitizen
See https://github.com/pypa/pipx, https://hatch.pypa.io/latest/install/ and https://commitizen-tools.github.io/commitizen/ for more install alternatives if needed, but we really recommend using pipx since that is isolated.
pyenv install $(pyenv latest -k 3.12)
pyenv local 3.12
./tools/recreate-virtualenv.sh
Alternatively, create virtualenv manually (this does the same as recreate-virtualenv.sh):
python -m venv .venv
the ./tools/recreate-virtualenv.sh script is just here to make creating virtualenvs more uniform across different repos because some repos will require extra setup in the virtualenv for package authentication etc.
source .venv/bin/activate # enable virtualenv
pip install -e ".[dev,test]"
This will upgrade all local packages according to the constraints set in pyproject.toml:
pip install --upgrade --upgrade-strategy=eager ".[dev,test]"
docker compose up
source .venv/bin/activate # enable virtualenv
ievv devrun
source .venv/bin/activate # enable virtualenv
pytest ievv_opensource
docker compose down -v
http://ievv-opensource.readthedocs.org/
First make sure you have NO UNCOMITTED CHANGES!
Release (create changelog, increment version, commit and tag the change) with:
cz bump
git push && git push --tags
cz bump
automatically updates CHANGELOG.md, updates version file(s), commits the change and tags the release commit.cz bump
will do, run it with --dry-run
. You can use
options to force a specific version instead of the one it automatically selects
from the git log if needed, BUT if this is needed, it is a sign that someone has messed
up with their conventional commits.cz bump
only works if conventional commits (see section about that above) is used.cz bump
can take a specific version etc, but it automatically select the correct version
if conventional commits has been used correctly. See https://commitizen-tools.github.io/commitizen/.docs: some useful message
commit.cz
command comes from commitizen
(install documented above).See How to revert a bump in the commitizen FAQ.
hatch build -t sdist
hatch publish
rm dist/* # optional cleanup
Replace rq.utils
with rq.logutils
"rq_console": {
"level": "DEBUG",
"class": "rq.logutils.ColorizingStreamHandler", //ColorizingStreamHandler is no longer in rq.utils, but in rq.logutils
"formatter": "rq_console",
"exclude": ["%(asctime)s"],
}
rq
is locked to >= 2.0.0 and < 3.0.0rq
major, django-rq
is locked to >= 3.0.0 < 4.0.0 for new rq
major support.Basically this is True
by default.
FAQs
The opensource modules from the commercial IEVV Django framework.
We found that ievv-opensource demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.