netprotocols 2.6.0__tar.gz → 2.8.0__tar.gz

{netprotocols-2.6.0 → netprotocols-2.8.0}/.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           python-version: "3.12"
       - run: uv run ruff check
@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           python-version: "3.12"
       - run: uv run mypy
@@ -55,7 +55,7 @@ jobs:
         python-version: ["3.12", "3.13", "3.14"]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           python-version: ${{ matrix.python-version }}
       - run: uv run --frozen pytest --cov=netprotocols --cov-report=term
@@ -70,7 +70,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           python-version: "3.12"
       - name: Export dev dependencies
@@ -86,7 +86,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - run: uv build
       - run: uv run --isolated --no-project --with dist/*.whl python -c "import netprotocols; print(netprotocols.__version__)"
       # Builds are supposed to be a pure function of the source tree, so
@@ -119,11 +119,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           python-version: "3.12"
       - run: uv build
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "22"
       - run: npm ci
@@ -151,7 +151,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           python-version: "3.12"
       - name: Corpus decode throughput

netprotocols-2.8.0/.github/workflows/codeql.yml

@@ -0,0 +1,100 @@
+name: CodeQL
+
+# Advanced-setup workflow (a checked-in file) rather than GitHub's
+# built-in "default setup", so this analysis lives in version control
+# alongside the rest of this repository's CI (ci.yml, fuzz.yml,
+# release.yml, mutation.yml, scorecard.yml) and its action pins are
+# reviewable the same way theirs are. Default setup is configured
+# through repository settings instead of a file, so it isn't available
+# to author from here.
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  schedule:
+    # Arbitrary; weekly on Sundays, clear of fuzz.yml's and mutation.yml's
+    # daily 03:00/04:00 UTC slots and scorecard.yml's own Sunday 05:00
+    # UTC slot.
+    - cron: "0 6 * * 0"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (python)
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # Python is interpreted, so there is nothing for autobuild (or a
+      # manual build step) to do: build-mode: none has CodeQL extract
+      # the database straight from source instead. This is the build
+      # mode the CodeQL Action's own docs recommend for interpreted
+      # languages, and it sidesteps the question of an autobuild step
+      # fitting this project's uv-based build at all.
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          languages: python
+          build-mode: none
+
+      # analyze writes the SARIF without uploading it, the filter step
+      # drops one query's results on two paths, and upload-sarif uploads
+      # what is left. py/weak-sensitive-data-hashing flags the MD5 that
+      # RADIUS (#265) and STUN (#267) mandate, which their tests and
+      # scripts/check_fixtures.py compute over published test secrets
+      # with usedforsecurity=False to verify captured traffic.
+      # The CodeQL config can't scope a query to paths: query-filters
+      # drops it everywhere, src/ included, and paths-ignore drops the
+      # paths from every query. So the filter removes only that query's
+      # results whose primary location is under tests/ or scripts/; the
+      # query still runs on src/, every other query on all three.
+      #
+      # upload: failure-only is the action's documented mode for a
+      # workflow that post-processes the SARIF: analyze uploads nothing
+      # when it succeeds. It still marks the analysis as completed, so
+      # init's post step does not upload a failed-run SARIF for a later
+      # step's failure either: if the filter or upload-sarif fails, the
+      # job goes red and no new analysis replaces the previous one
+      # (upload-sarif can fail after uploading, while it waits for
+      # processing). That fails closed; unfiltered SARIF is never
+      # uploaded. (Any value the action does not recognize means
+      # `always`, which would upload before the filter runs.)
+      #
+      # Neither analyze nor upload-sarif sets `category`, and that is
+      # what keeps the analysis the same one: with no category the CLI
+      # writes no runs[].automationDetails, and both actions then fill
+      # it in from the workflow path, job id and matrix,
+      # ".github/workflows/codeql.yml:analyze/", the same in both
+      # steps of this job. Existing alerts keep tracking (fixed ones
+      # close, the rest stay) rather than reappearing under a new
+      # category. Setting one on either step alone would start a second
+      # analysis next to the first.
+      - id: analyze
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          upload: failure-only
+
+      # Rewrites each *.sarif under analyze's output directory, at any
+      # depth and skipping symlinks (as upload-sarif finds them), in
+      # place and logs one line per file, by its path under the
+      # directory, naming every result it dropped; malformed SARIF fails
+      # the job instead of uploading unfiltered results.
+      # Stdlib only, so the runner's own python3 runs it.
+      - name: Drop weak-hashing results on tests/ and scripts/
+        env:
+          SARIF_DIR: ${{ steps.analyze.outputs.sarif-output }}
+        run: python3 scripts/filter_codeql_sarif.py "$SARIF_DIR"
+
+      - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          sarif_file: ${{ steps.analyze.outputs.sarif-output }}

{netprotocols-2.6.0 → netprotocols-2.8.0}/.github/workflows/fuzz.yml

@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           python-version: "3.12"
       # Keyed by run id with a prefix restore-key: a fixed key would
@@ -65,7 +65,7 @@ jobs:
       # repo write access to re-run the job locally.
       - name: Upload the failing example database
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: hypothesis-nightly-failure-${{ github.run_id }}
           path: .hypothesis
@@ -85,7 +85,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           python-version: "3.12"
       - name: Run Atheris against decode_frame
@@ -98,7 +98,7 @@ jobs:
             python tests/fuzz/fuzz_http_decode.py -max_total_time=300
       - name: Upload crash artifacts
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: atheris-crash-${{ github.run_id }}
           path: crash-*

{netprotocols-2.6.0 → netprotocols-2.8.0}/.github/workflows/mutation.yml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           python-version: "3.12"
       # mutmut hashes each mutated file plus the tests that cover it and
@@ -104,7 +104,7 @@ jobs:
       # doesn't exist is silently skipped.
       - name: Upload mutmut results on failure
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: mutmut-nightly-failure-${{ github.run_id }}
           path: |

{netprotocols-2.6.0 → netprotocols-2.8.0}/.github/workflows/release.yml

@@ -35,7 +35,7 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - run: uv build
       # The QA ladder cannot catch a mistagged release: every check
       # passes because the code is fine and only the tag is wrong. Read
@@ -99,7 +99,7 @@ jobs:
             --pyproject pyproject.toml --mc-type library \
             -o "netprotocols-${GITHUB_REF_NAME#v}.cdx.json"
       - name: Upload release assets
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-assets
           path: |
@@ -123,7 +123,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download release assets
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-assets
       # CHANGELOG.md is the single source of truth for release notes, so

{netprotocols-2.6.0 → netprotocols-2.8.0}/.github/workflows/scorecard.yml

@@ -48,7 +48,7 @@ jobs:
       # Upload the SARIF results as a workflow artifact, per the action's
       # standard setup.
       - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: SARIF file
           path: results.sarif
@@ -56,6 +56,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: results.sarif

{netprotocols-2.6.0 → netprotocols-2.8.0}/.gitignore

@@ -146,7 +146,8 @@ amass.txt
 amass.log
 
 # Application-specific
-.logs/tests/fixtures/staging/
+.logs/
+tests/fixtures/staging/
 
 # Written by the benchmark CI step (scripts/benchmark.py output)
 benchmark.out