depquiet 0.3.0__tar.gz

depquiet-0.3.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,69 @@
+name: Bug Report
+description: Something isn't working correctly
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug! Please fill out the sections below so we can reproduce and fix it.
+
+  - type: input
+    id: version
+    attributes:
+      label: depquiet version
+      description: Run `depquiet --version`
+      placeholder: "0.1.0"
+    validations:
+      required: true
+
+  - type: input
+    id: python-version
+    attributes:
+      label: Python version
+      description: Run `python --version`
+      placeholder: "3.13.0"
+    validations:
+      required: true
+
+  - type: input
+    id: os
+    attributes:
+      label: Operating System
+      placeholder: "macOS 15.1 / Ubuntu 24.04 / Windows 11"
+    validations:
+      required: true
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: Describe the bug. What did you expect to happen?
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: The exact commands you ran
+      render: bash
+    validations:
+      required: true
+
+  - type: textarea
+    id: output
+    attributes:
+      label: Error output
+      description: Paste the full terminal output
+      render: text
+    validations:
+      required: false
+
+  - type: textarea
+    id: audit-json
+    attributes:
+      label: Audit JSON (if relevant)
+      description: Paste or attach the audit JSON that triggered the bug. Sanitize private package names if needed.
+      render: json
+    validations:
+      required: false

depquiet-0.3.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,47 @@
+name: Feature Request
+description: Suggest a new feature or improvement
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Have an idea to make depquiet better? We'd love to hear it.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What problem does this feature solve? What's frustrating today?
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: How do you imagine this working?
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Any other approaches you've thought about?
+    validations:
+      required: false
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - New filter
+        - New parser (package manager)
+        - CLI / output
+        - SARIF / integrations
+        - Templates
+        - Documentation
+        - Other
+    validations:
+      required: true

depquiet-0.3.0/.github/ISSUE_TEMPLATE/template_contribution.yml

@@ -0,0 +1,53 @@
+name: Template Contribution
+description: Propose a new dismiss template for a known false positive
+labels: ["template"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Community templates are what make depquiet powerful. Thanks for contributing one!
+
+  - type: input
+    id: template-id
+    attributes:
+      label: Template ID
+      description: A short kebab-case identifier
+      placeholder: "prototype-pollution-lodash"
+    validations:
+      required: true
+
+  - type: textarea
+    id: cves
+    attributes:
+      label: CVEs covered
+      description: List each CVE on its own line
+      placeholder: |
+        CVE-2020-8203
+        CVE-2019-10744
+    validations:
+      required: true
+
+  - type: input
+    id: packages
+    attributes:
+      label: Affected packages
+      description: Comma-separated package names
+      placeholder: "lodash, lodash.merge"
+    validations:
+      required: true
+
+  - type: textarea
+    id: reason
+    attributes:
+      label: Why is this safe to dismiss?
+      description: Explain why this CVE is a false positive in most projects. Be specific about the conditions under which it IS exploitable.
+    validations:
+      required: true
+
+  - type: textarea
+    id: references
+    attributes:
+      label: References
+      description: Links to advisories, blog posts, or discussions that support this template
+    validations:
+      required: true

depquiet-0.3.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,27 @@
+## What does this PR do?
+
+<!-- A brief description of the change -->
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] New template
+- [ ] New parser (package manager support)
+- [ ] Documentation
+- [ ] Refactor (no behavior change)
+
+## Checklist
+
+- [ ] I've read [CONTRIBUTING.md](../CONTRIBUTING.md)
+- [ ] Tests pass locally (`pytest tests/ -v`)
+- [ ] Linting passes (`ruff check src/ tests/`)
+- [ ] Type checking passes (`mypy src/depquiet/`)
+- [ ] I've added tests for new functionality
+- [ ] I've updated the README if this adds user-facing features
+
+## For template contributions
+
+- [ ] Every CVE is real and verifiable
+- [ ] The `reason` explains why it's safe to dismiss
+- [ ] File name matches the `id` field

depquiet-0.3.0/.github/workflows/ci.yml

@@ -0,0 +1,71 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint & Type Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+      - name: Ruff check
+        run: ruff check src/ tests/
+      - name: Ruff format check
+        run: ruff format --check src/ tests/
+      - name: Mypy
+        run: mypy src/depquiet/ --ignore-missing-imports
+
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    needs: lint
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+      - name: Run tests with coverage
+        run: python -m pytest tests/ -v --cov=depquiet --cov-report=xml --cov-report=term-missing
+      - name: Upload coverage
+        if: matrix.python-version == '3.13'
+        uses: codecov/codecov-action@v4
+        with:
+          file: coverage.xml
+          fail_ci_if_error: false
+
+  build:
+    name: Build Package
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Install build tools
+        run: pip install build
+      - name: Build sdist and wheel
+        run: python -m build
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/

depquiet-0.3.0/.github/workflows/release.yml

@@ -0,0 +1,36 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  release:
+    name: Build & Publish
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install build tools
+        run: pip install build
+
+      - name: Build package
+        run: python -m build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          files: dist/*

depquiet-0.3.0/.gitignore

@@ -0,0 +1,20 @@
+__pycache__/
+*.py[cod]
+*$py.class
+*.egg-info/
+dist/
+build/
+.eggs/
+*.egg
+.venv/
+venv/
+.env
+.pytest_cache/
+.coverage
+coverage.xml
+htmlcov/
+.ruff_cache/
+.mypy_cache/
+*.sarif
+.depquiet-cache/
+benchmarks/results.json

depquiet-0.3.0/CHANGELOG.md

@@ -0,0 +1,77 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.3.0] - 2026-11-01
+
+### Added
+
+- **Grype parser**: triage Anchore Grype output via `grype dir:. -o json | depquiet --stdin` — auto-detects `matches` array, deduplicates CVE+package, maps artifact types to depquiet ecosystems, handles both modern and legacy fix formats
+- **Dependabot parser**: triage GitHub Dependabot alerts via `gh api /repos/OWNER/REPO/dependabot/alerts --paginate | depquiet --stdin` — auto-detects JSON arrays, processes only open alerts, deduplicates CVE+package, handles GHSA-only advisories
+- **Dependabot example** in `examples/dependabot-alerts/` with sample alerts and expected verdicts
+- **Benchmark suite**: reproducible filter-rate measurement across 4 scenarios — **89% noise reduction** proven across npm, pip, trivy, and grype
+
+### Changed
+
+- **Python reachability analysis**: upgraded from bare string matching to proper `import X` / `from X import Y` / `__import__('X')` detection — prevents false positives from package names appearing in comments or prose
+- **Mixed-project reachability**: `check()` now searches both JS and Python files instead of picking one ecosystem, so mixed-language projects triage correctly
+- trivy.py test coverage raised from 84% to 100%
+- Test suite expanded from 156 to 234 tests
+- Coverage maintained at **100%** across all 19 source files (869/869 statements)
+
+## [0.2.0] - 2026-11-01
+
+### Added
+
+- **Trivy parser**: auto-detects `trivy fs --format json` output via `--stdin`, processes `lang-pkgs` results (skips OS packages)
+- **`.depquiet.yaml` config file**: commit triage preferences alongside code — `epss_threshold`, `template_dirs`, `always_flag`, `offline`
+- **`--config` CLI flag**: specify a custom config file path instead of the default `.depquiet.yaml` in the project root
+- **`always_flag`**: packages that must never be filtered — forced to ACTION verdict regardless of filters
+- **7 new community templates**: express open redirect, axios SSRF, webpack-dev-middleware, json5 prototype pollution, ip SSRF, requests proxy-auth leak, cryptography null dereference (9 total)
+- **Trivy container example** in `examples/trivy-container/`
+- **Node.js API example** with `.depquiet.yaml` config in `examples/node-api/`
+- **Python web app example** in `examples/python-web/`
+- PEP 561 `py.typed` marker for typed package compliance
+
+### Changed
+
+- Full `mypy --strict` compliance across all source files
+- All bare `dict` annotations replaced with `dict[str, Any]`
+- Parser list uses `Protocol` for structural typing
+- Test suite expanded from 29 to 156 tests
+- Coverage raised from 84% to 99%
+
+### Fixed
+
+- SARIF output bug: `_build_locations` crashed on missing imports field
+- `_parse_yaml_simple` return type narrowed from `dict` to `dict[str, object]` for mypy strict
+
+## [0.1.0] - 2026-10-31
+
+### Added
+
+- Core triage engine with four filters: devDependency, reachability, EPSS, and community templates
+- npm audit JSON parser with full advisory support
+- pip-audit JSON parser (stub, expandable)
+- EPSS score integration via FIRST.org API (`--offline` to skip)
+- Import reachability analysis for JavaScript/TypeScript projects
+- Community template system with YAML-based dismiss rules
+- Bundled templates: lodash prototype pollution, semver ReDoS
+- SARIF v2.1.0 output for GitHub Code Scanning integration
+- JSON output mode for programmatic consumption
+- Colored terminal output with before/after noise reduction display
+- CLI with `--sarif`, `--json`, `--offline`, `--stdin`, `--epss-threshold`, `--templates`
+- CI exit code: 1 if ACTION items found, 0 otherwise
+- Full test suite with 29 tests
+- CI workflow with lint, typecheck, test matrix (3.11/3.12/3.13), and build
+- Automated release workflow with trusted PyPI publishing
+
+[Unreleased]: https://github.com/samuelrojas-dev/depquiet/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/samuelrojas-dev/depquiet/compare/v0.2.0...v0.3.0
+[0.2.0]: https://github.com/samuelrojas-dev/depquiet/compare/v0.1.0...v0.2.0
+[0.1.0]: https://github.com/samuelrojas-dev/depquiet/releases/tag/v0.1.0

depquiet-0.3.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,65 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+**sarojas123@icloud.com**.
+
+All complaints will be reviewed and investigated promptly and fairly.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+[homepage]: https://www.contributor-covenant.org

depquiet-0.3.0/CONTRIBUTING.md

@@ -0,0 +1,122 @@
+# Contributing to depquiet
+
+Thanks for your interest in contributing! depquiet is an open source tool that helps developers cut through vulnerability alert noise, and contributions from the community are what make it great.
+
+## Quick Start
+
+```bash
+git clone https://github.com/samuelrojas-dev/depquiet.git
+cd depquiet
+python -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev]"
+python -m pytest tests/ -v
+```
+
+## Ways to Contribute
+
+### Community Templates (easiest way to start)
+
+The fastest way to contribute is by adding **dismiss templates** — curated rules that help depquiet filter known false positives.
+
+Templates live in `templates/dismiss/` and look like this:
+
+```yaml
+id: prototype-pollution-lodash
+title: Prototype pollution in lodash (not exploitable in most apps)
+cves:
+  - CVE-2020-8203
+  - CVE-2019-10744
+packages:
+  - lodash
+reason: >
+  Prototype pollution in lodash requires attacker-controlled input
+  to _.merge, _.defaultsDeep, or _.zipObjectDeep. Most applications
+  do not pass untrusted input to these functions.
+references:
+  - https://github.com/advisories/GHSA-jf85-cpcp-j695
+```
+
+**Rules for templates:**
+
+1. Every CVE must be real and verifiable
+2. The `reason` must explain *why* it's safe to dismiss — not just that it's low severity
+3. One template per logical group (e.g., all lodash prototype pollution CVEs together)
+4. File name matches the `id` field: `{id}.yaml`
+
+### Code Contributions
+
+1. **Fork and branch**: create a feature branch from `main`
+2. **Write tests first**: every new feature or bugfix needs a test in `tests/`
+3. **Follow the style**: we use `ruff` for linting and `mypy` for type checking
+4. **Keep dependencies at zero**: depquiet has zero runtime dependencies by design. If you need a library, it goes in `[project.optional-dependencies]`
+5. **Run the checks**:
+
+```bash
+ruff check src/ tests/
+ruff format --check src/ tests/
+mypy src/depquiet/ --ignore-missing-imports
+python -m pytest tests/ -v --cov=depquiet
+```
+
+### Bug Reports
+
+Open an issue with:
+
+- Your Python version and OS
+- The command you ran
+- The full error output
+- If possible, the audit JSON that triggered the bug (sanitize any private package names)
+
+### Feature Requests
+
+Open an issue describing:
+
+- The problem you're trying to solve
+- How you imagine the solution working
+- Any alternatives you've considered
+
+## Architecture Overview
+
+```
+src/depquiet/
+├── cli.py          # Entry point, argument parsing
+├── config.py       # .depquiet.yaml config file support
+├── engine.py       # Core orchestrator — runs parsers + filters
+├── models.py       # Dataclasses: Vulnerability, FilterResult
+├── output.py       # Terminal output with colors
+├── sarif.py        # SARIF v2.1.0 export
+├── parsers/
+│   ├── npm.py         # npm audit JSON parser
+│   ├── pip.py         # pip-audit JSON parser
+│   ├── trivy.py       # Trivy JSON parser (lang-pkgs only)
+│   ├── dependabot.py  # GitHub Dependabot alerts parser
+│   └── grype.py       # Anchore Grype JSON parser
+└── filters/
+    ├── devdep.py       # devDependency filter
+    ├── reachability.py # Import reachability analysis
+    ├── epss.py         # EPSS score filter
+    └── templates.py    # Community template matcher
+```
+
+**Key design principles:**
+
+- Parsers convert tool-specific JSON into `Vulnerability` objects
+- Filters take a list of vulnerabilities and return `FilterResult` objects with a reason
+- The engine runs parsers then filters in order
+- Output formatters (terminal, JSON, SARIF) consume `FilterResult` lists
+
+## Pull Request Process
+
+1. Update tests to cover your changes
+2. Ensure all checks pass (`ruff`, `mypy`, `pytest`)
+3. Update the README if you're adding user-facing features
+4. Fill out the PR template
+5. A maintainer will review within a few days
+
+## Code of Conduct
+
+This project follows the [Contributor Covenant](CODE_OF_CONDUCT.md). By participating, you agree to uphold a welcoming, inclusive environment.
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the MIT License.

depquiet-0.3.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Samuel Rojas
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.