monitor-app 2.3.0__tar.gz → 2.3.1__tar.gz

{monitor_app-2.3.0 → monitor_app-2.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: monitor-app
-Version: 2.3.0
+Version: 2.3.1
 Summary: Drop in a CSV, write one config file, and get a live-updating Web UI + REST API. FastAPI-based data monitoring for shop floors and small teams.
 License-Expression: MIT
 License-File: LICENSE
@@ -25,16 +25,17 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Provides-Extra: xlsx
 Requires-Dist: click (>=8.1,<8.2)
-Requires-Dist: fastapi (>=0.115,<1.0)
+Requires-Dist: fastapi (>=0.133,<1.0)
 Requires-Dist: jinja2 (>=3.1,<4.0)
 Requires-Dist: openpyxl (>=3.1,<4.0) ; extra == "xlsx"
-Requires-Dist: pg8000 (>=1.30,<2.0)
+Requires-Dist: pg8000 (>=1.31.5,<2.0)
 Requires-Dist: pydantic (>=2.7,<3.0)
 Requires-Dist: pydantic-settings (>=2.3,<3.0)
 Requires-Dist: pymysql (>=1.1,<2.0)
-Requires-Dist: python-multipart (>=0.0.9)
+Requires-Dist: python-multipart (>=0.0.31)
 Requires-Dist: sqlalchemy (>=2.0,<3.0)
 Requires-Dist: sse-starlette (>=2.1,<3.0)
+Requires-Dist: starlette (>=1.3.1,<2.0)
 Requires-Dist: typer (>=0.12,<1.0)
 Requires-Dist: uvicorn[standard] (>=0.30,<1.0)
 Project-URL: Changelog, https://github.com/mikawa-bushi/monitor-app/blob/main/CHANGELOG.md
@@ -234,6 +235,30 @@ poetry install
 poetry run pytest
 ```
 
+### Pre-push security & quality checks
+
+A [pre-commit](https://pre-commit.com/) config scans for **secrets** and enforces
+formatting locally, before code leaves your machine. Enable it once per clone:
+
+```sh
+poetry run pre-commit install          # installs the commit + pre-push hooks
+poetry run pre-commit run --all-files  # optional: run across the repo now
+```
+
+- **gitleaks** — blocks hard-coded secrets (PyPI/AWS/GCP tokens, GitHub PATs, private keys)
+- **detect-private-key / check-added-large-files / check-merge-conflict**, plus **black / ruff** (pinned to the CI versions)
+- **check-commit-identity** (pre-push) — rejects commits whose author/committer e-mail is off the allowlist, keeping work/other identities out of history (`scripts/check_commit_identity.py`; extend via the `MONITOR_ALLOWED_EMAILS` env var)
+- **check-ai-traces** (commit + pre-push) — flags traces of AI-agent tools (config dirs, file content, commit metadata) so they don't leak into the repo. Tool patterns are data-driven in `scripts/check_ai_traces.py` (extend the `TOOLS` list or `MONITOR_AI_TRACE_EXTRA`; ignore paths via `.ai-trace-ignore`)
+
+Audit the **whole working tree and full git history** on demand:
+
+```sh
+python3 scripts/check_ai_traces.py --all   # exit 0 = no traces found
+```
+
+> ⚠️ Local hooks can be skipped with `git commit/push --no-verify`. For an
+> unbypassable gate, also make `gitleaks` a required GitHub Actions check.
+
 Contributions are welcome — see [CONTRIBUTING.md](https://github.com/mikawa-bushi/monitor-app/blob/main/CONTRIBUTING.md).
 
 ## 📜 License

{monitor_app-2.3.0 → monitor_app-2.3.1}/README.md

@@ -189,6 +189,30 @@ poetry install
 poetry run pytest
 ```
 
+### Pre-push security & quality checks
+
+A [pre-commit](https://pre-commit.com/) config scans for **secrets** and enforces
+formatting locally, before code leaves your machine. Enable it once per clone:
+
+```sh
+poetry run pre-commit install          # installs the commit + pre-push hooks
+poetry run pre-commit run --all-files  # optional: run across the repo now
+```
+
+- **gitleaks** — blocks hard-coded secrets (PyPI/AWS/GCP tokens, GitHub PATs, private keys)
+- **detect-private-key / check-added-large-files / check-merge-conflict**, plus **black / ruff** (pinned to the CI versions)
+- **check-commit-identity** (pre-push) — rejects commits whose author/committer e-mail is off the allowlist, keeping work/other identities out of history (`scripts/check_commit_identity.py`; extend via the `MONITOR_ALLOWED_EMAILS` env var)
+- **check-ai-traces** (commit + pre-push) — flags traces of AI-agent tools (config dirs, file content, commit metadata) so they don't leak into the repo. Tool patterns are data-driven in `scripts/check_ai_traces.py` (extend the `TOOLS` list or `MONITOR_AI_TRACE_EXTRA`; ignore paths via `.ai-trace-ignore`)
+
+Audit the **whole working tree and full git history** on demand:
+
+```sh
+python3 scripts/check_ai_traces.py --all   # exit 0 = no traces found
+```
+
+> ⚠️ Local hooks can be skipped with `git commit/push --no-verify`. For an
+> unbypassable gate, also make `gitleaks` a required GitHub Actions check.
+
 Contributions are welcome — see [CONTRIBUTING.md](https://github.com/mikawa-bushi/monitor-app/blob/main/CONTRIBUTING.md).
 
 ## 📜 License

{monitor_app-2.3.0 → monitor_app-2.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "monitor-app"
-version = "2.3.0"
+version = "2.3.1"
 description = "Drop in a CSV, write one config file, and get a live-updating Web UI + REST API. FastAPI-based data monitoring for shop floors and small teams."
 authors = [{ name = "hardwork9047", email = "tomatosimple1104@gmail.com" }]
 readme = "README.md"
@@ -25,7 +25,9 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
 ]
 dependencies = [
-    "fastapi (>=0.115,<1.0)",
+    # fastapi <0.133 は starlette を <1.0 に固定しており、starlette の脆弱性修正
+    # (>=1.3.1) と両立しない。0.133 で starlette の上限が外れた
+    "fastapi (>=0.133,<1.0)",
     "uvicorn[standard] (>=0.30,<1.0)",
     "pydantic (>=2.7,<3.0)",
     "pydantic-settings (>=2.3,<3.0)",
@@ -34,10 +36,12 @@ dependencies = [
     # typer 0.12 系は click 8.2 の API 変更と非互換
     "click (>=8.1,<8.2)",
     "jinja2 (>=3.1,<4.0)",
-    "python-multipart (>=0.0.9)",
+    # CORSMiddleware を直接 import するため明示宣言。複数 CVE のため下限を固定
+    "starlette (>=1.3.1,<2.0)",
+    "python-multipart (>=0.0.31)",
     "sse-starlette (>=2.1,<3.0)",
     "pymysql (>=1.1,<2.0)",   # MySQL 対応
-    "pg8000 (>=1.30,<2.0)",   # PostgreSQL 対応
+    "pg8000 (>=1.31.5,<2.0)",   # PostgreSQL 対応（CVE-2025-61385 修正）
 ]
 
 [project.optional-dependencies]
@@ -61,11 +65,12 @@ include = [
 ]
 
 [tool.poetry.group.dev.dependencies]
-pytest = "^8.3.4"
+pytest = "^9.0.3"
 pytest-cov = "^7.0"
 httpx = "^0.27.0"
-black = "^24.0.0"
+black = "^26.3.1"
 ruff = "^0.15"
+pre-commit = "^4.0"
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]