
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
This plugin enables you to run vulture
(https://pypi.org/project/vulture/) alongside pytest
,
allowing for dead code detection during your testing process.
To integrate vulture
with pytest
and find dead code, use the following commands:
Basic Usage
Run vulture
with pytest
to check for dead code:
.. code-block:: shell
pytest --vulture
Custom Configuration Specify a custom configuration file path:
.. code-block:: shell
pytest --vulture --vulture-cfg-file=/path/to/vulture.ini
Note: By default, the tool looks for configuration files in the following order:
pyproject.toml
tox.ini
vulture.ini
You can ignore specific warnings from vulture
directly in the source code. Here’s how:
Ignore Specific Lines:
.. code-block:: python
def test_function():
unused_variable = 42 # vulture: ignore
Ignore Entire Methods:
.. code-block:: python
def ignored_function(): # vulture: ignore
pass
Ignore Classes:
.. code-block:: python
class IgnoredClass: # vulture: ignore
pass
pyproject.toml
Here’s an example of how to configure vulture
using pyproject.toml
:
.. code-block:: toml
[tool.vulture]
# Exclude specific paths (e.g., test directories)
exclude = [
"*/test/*",
]
# Ignore specific files in the `pytest` output (but they are still checked by `vulture`)
ignore = [
"src/some_ignored_file.py",
]
# Ignore specific function or variable names
ignore-names = [
"deprecated_function",
]
# Ignore decorators
ignore-decorators = [
"@app.route",
"@celery.task",
]
# Ignore specific types of messages (e.g., imports)
ignore-types = [
"import",
]
# Define the source path
source-path = "src"
.ini
Config FilesHere’s an example of how to configure vulture
using an .ini
file:
.. code-block:: ini
[vulture]
exclude =
*/test/* # Usually exclude tests as they may cover dead code
ignore =
src/some_ignored_file.py
ignore-names =
deprecated_function
ignore-decorators =
@app.route
@celery.task
ignore-types =
attribute
variable
This code depends on
vulture <https://pypi.org/project/vulture>
__
If you want to help development, there is overview documentation in DEVELOPMENT.rst.
If you encounter any problems, please file an issue along with a detailed description.
2.2.0
- Add pyproject.toml support for parameters
2.0.2
1.0.0
- stable Gatewatcher internal use only
0.x
FAQs
A pytest plugin to checks dead code with vulture
We found that pytest-vulture demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.