Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A Poetry plugin to automate releasing new versions of Python packages.
Features
pyproject.toml
(like the poetry version
command) & in your package source codepoetry-changelog
)Plugins work with Poetry version 1.2.0a2
or above.
$ poetry plugin add nr.poetry-release
$ poetry release patch --tag --push
This will
pyproject.toml
and synchronize all other built-in and configured places
where the version number is referencedIn addition to the version rules already supported by poetry version
, the poetry release
plugin supports a git
rule which will construct a version number based on the last Git tag and the commit distance. Note that this version
number is not PyPI compatible, but can be used to publish for example to Artifactory.
Using the --verify
option will instead check if the specified version number is used consistently across all version
references and is useful in CI.
Release branch
If in a Git project, unless --no-branch-check
is passed, poetry release
will prevent you from creating the
release unless the worktree is currently on the configured release branch (develop
by default). The release
branch can be changed by setting the tool.nr.poetry-release.branch
option in pyproject.toml
.
[tool.nr.poetry-release]
branch = "main"
Tag format
When using the --tag
option, a Git tag will be created with the target version as its name. The name assigned to the
new tag can be changed by setting the tool.nr.poetry-release.tag-format
option in pyproject.toml
. For example, if the
target version is 1.0.0
but the tag name should be v1.0.0
, the configuration to use is:
[tool.nr.poetry-release]
tag-format = "v{version}"
Additional version references
You can configure additional references to the version number in your project using the tool.nr.poetry-release.references
option. It must be a list of tables that define the files and a regular expression to find the version number.
[tool.nr.poetry-release]
references = [
{ file = "../frontend/package.json", pattern = " \"version\": \"{version}\"," }
]
In addition to this configuration option, plugins of type peotry_release.plugin_api.PoetryReleasePlugin
registered
under the poetry_release.plugins
entrypoint will be used to detect additional version number references, or register
a callback to modify file(s) with respect to the target version number.
FAQs
A Poetry plugin to automate the release process of Python packages.
We found that nr.poetry-release demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.