cycode 3.20.1.dev1__tar.gz → 3.20.1.dev3__tar.gz

{cycode-3.20.1.dev1 → cycode-3.20.1.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.20.1.dev1
+Version: 3.20.1.dev3
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE
@@ -24,7 +24,7 @@ Requires-Dist: anyio (>=4.0.0,<4.13.0)
 Requires-Dist: arrow (>=1.0.0,<1.5.0)
 Requires-Dist: click (>=8.1.0,<8.2.0)
 Requires-Dist: colorama (>=0.4.3,<0.5.0)
-Requires-Dist: gitpython (>=3.1.51,<3.2.0)
+Requires-Dist: gitpython (>=3.1.58,<3.2.0)
 Requires-Dist: marshmallow (>=4.0.1,<4.1.0)
 Requires-Dist: mcp (>=1.28.1,<2.0.0) ; python_version >= "3.10"
 Requires-Dist: patch-ng (==1.19.1)

{cycode-3.20.1.dev1 → cycode-3.20.1.dev3}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.20.1.dev1'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.20.1.dev3'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.20.1.dev1 → cycode-3.20.1.dev3}/cycode/cli/utils/yaml_utils.py

@@ -1,4 +1,5 @@
 import os
+import tempfile
 from collections.abc import Hashable
 from typing import Any, TextIO
 
@@ -34,22 +35,48 @@ def _yaml_object_safe_load(file: TextIO) -> dict[Hashable, Any]:
     return loaded_file
 
 
+def _quarantine_corrupt_file(filename: str) -> None:
+    # Renamed rather than deleted: the file may hold the only copy of the user's credentials,
+    # and keeping it around leaves something to look at in the next bug report.
+    try:
+        os.replace(filename, f'{filename}.corrupt')
+    except OSError as e:
+        logger.warning('Failed to quarantine corrupt file, %s', {'filename': filename}, exc_info=e)
+
+
 def read_yaml_file(filename: str) -> dict[Hashable, Any]:
     if not os.access(filename, os.R_OK) or not os.path.exists(filename):
         logger.debug('Config file is not accessible or does not exist: %s', {'filename': filename})
         return {}
 
-    with open(filename, encoding='UTF-8') as file:
-        return _yaml_object_safe_load(file)
+    try:
+        with open(filename, encoding='UTF-8') as file:
+            return _yaml_object_safe_load(file)
+    except yaml.YAMLError as e:
+        logger.warning('Config file is corrupt and will be moved aside, %s', {'filename': filename}, exc_info=e)
+        _quarantine_corrupt_file(filename)
+        return {}
 
 
 def write_yaml_file(filename: str, content: dict[Hashable, Any]) -> None:
-    if not os.access(filename, os.W_OK) and os.path.exists(filename):
+    directory = os.path.dirname(filename)
+    if not os.access(directory, os.W_OK) or (os.path.exists(filename) and not os.access(filename, os.W_OK)):
         logger.warning('No write permission for file. Cannot save config, %s', {'filename': filename})
         return
 
-    with open(filename, 'w', encoding='UTF-8') as file:
-        yaml.safe_dump(content, file)
+    # Atomic write to avoid race conditions between concurrent CLI processes
+    file_descriptor, temp_filename = tempfile.mkstemp(dir=directory, prefix=f'.{os.path.basename(filename)}.')
+    try:
+        with os.fdopen(file_descriptor, 'w', encoding='UTF-8') as file:
+            yaml.safe_dump(content, file)
+            file.flush()
+            os.fsync(file.fileno())
+
+        os.replace(temp_filename, filename)
+    except Exception:
+        if os.path.exists(temp_filename):
+            os.remove(temp_filename)
+        raise
 
 
 def update_yaml_file(filename: str, content: dict[Hashable, Any]) -> None:

{cycode-3.20.1.dev1 → cycode-3.20.1.dev3}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.20.1.dev1"
+version = "3.20.1.dev3"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"
@@ -39,7 +39,7 @@ pyyaml = ">=6.0,<7.0"
 # capped while we support Python 3.9
 marshmallow = ">=4.0.1,<4.1.0"
 # floor required by get_staged_diff_index()
-gitpython = ">=3.1.51,<3.2.0"
+gitpython = ">=3.1.58,<3.2.0"
 arrow = ">=1.0.0,<1.5.0"
 requests = ">=2.32.4,<3.0"
 urllib3 = ">=2.4.0,<3.0.0"