Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Check for stylistic and formal issues in .rst and .py files included in the documentation.
Sphinx Lint is based on rstlint.py from CPython.
Sphinx Lint should:
Here are some example invocations of Sphinx Lint from the command line:
sphinx-lint # check all dirs and files
sphinx-lint file.rst # check a single file
sphinx-lint docs # check a directory
sphinx-lint -i venv # ignore a file/directory
sphinx-lint -h # for more options
Sphinx Lint can also be used via pre-commit. We recommend using a configuration like this:
- repo: https://github.com/sphinx-contrib/sphinx-lint
rev: LATEST_SPHINXLINT_RELEASE_TAG
hooks:
- id: sphinx-lint
Currently Sphinx Lint can't work with tables, there's no understanding
of how linesplit
works in tables, like:
+-----------------------------------------+-----------------------------+---------------+
| Method | Checks that | New in |
+=========================================+=============================+===============+
| :meth:`assertEqual(a, b) | ``a == b`` | |
| <TestCase.assertEqual>` | | |
+-----------------------------------------+-----------------------------+---------------+
as Sphinx Lint works line by line it will inevitably think the :meth:
role is not closed properly.
To avoid false positives, some rules are skipped if we're in a table.
A quick way to test if some syntax is valid from a pure
reStructuredText point of view, one case use docutils
's pseudoxml
writer, like:
$ docutils --writer=pseudoxml tests/fixtures/xpass/role-in-code-sample.rst
<document source="tests/fixtures/xpass/role-in-code-sample.rst">
<paragraph>
Found in the pandas documentation, this is valid:
<bullet_list bullet="*">
<list_item>
<paragraph>
A pandas class (in the form
<literal>
:class:`pandas.Series`
)
<list_item>
<paragraph>
A pandas method (in the form
<literal>
:meth:`pandas.Series.sum`
)
<list_item>
<paragraph>
A pandas function (in the form
<literal>
:func:`pandas.to_datetime`
)
<paragraph>
it's documenting roles using code samples (double backticks).
Make sure that the CI tests pass and optionally double-check locally with "friends projects" by running:
sh download-more-tests.sh
python -m pytest
Go on the Releases page
Click "Draft a new release"
Click "Choose a tag"
Type the next vX.Y.Z version and select "Create new tag: vX.Y.Z on publish"
Leave the "Release title" blank (it will be autofilled)
Click "Generate release notes" and amend as required
Click "Publish release"
Check the tagged GitHub Actions build has deployed to PyPI
As this script was in the CPython repository the license is the Python Software Foundation Licence Version 2, see the LICENSE file for a full version.
FAQs
Check for stylistic and formal issues in .rst and .py files included in the documentation.
We found that sphinx-lint demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.