pytest-language-server 0.3.0__tar.gz → 0.3.1__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pytest_language_server-0.3.1/.github/dependabot.yml +44 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/.github/workflows/release.yml +8 -8
- pytest_language_server-0.3.1/.github/workflows/security.yml +95 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/.pre-commit-config.yaml +16 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/Cargo.lock +1 -1
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/Cargo.toml +1 -1
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/PKG-INFO +47 -1
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/README.md +45 -0
- pytest_language_server-0.3.1/SECURITY.md +131 -0
- pytest_language_server-0.3.1/bump-version.sh +46 -0
- pytest_language_server-0.3.1/deny.toml +53 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/pyproject.toml +2 -1
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/.github/workflows/ci.yml +0 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/.gitignore +0 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/Formula/pytest-language-server.rb +0 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/LICENSE +0 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/RELEASE.md +0 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/src/fixtures.rs +0 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/src/main.rs +0 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/tests/manual_test.py +0 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/tests/test_parser_api.rs +0 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/tests/test_project/conftest.py +0 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/tests/test_project/test_example.py +0 -0
- {pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/uv.lock +0 -0
|
@@ -0,0 +1,44 @@
|
|
|
1
|
+
version: 2
|
|
2
|
+
updates:
|
|
3
|
+
# Rust dependencies
|
|
4
|
+
- package-ecosystem: "cargo"
|
|
5
|
+
directory: "/"
|
|
6
|
+
schedule:
|
|
7
|
+
interval: "weekly"
|
|
8
|
+
day: "monday"
|
|
9
|
+
time: "09:00"
|
|
10
|
+
timezone: "UTC"
|
|
11
|
+
open-pull-requests-limit: 10
|
|
12
|
+
reviewers:
|
|
13
|
+
- "bellini666"
|
|
14
|
+
labels:
|
|
15
|
+
- "dependencies"
|
|
16
|
+
- "rust"
|
|
17
|
+
commit-message:
|
|
18
|
+
prefix: "deps"
|
|
19
|
+
include: "scope"
|
|
20
|
+
groups:
|
|
21
|
+
rust-minor-patch:
|
|
22
|
+
patterns:
|
|
23
|
+
- "*"
|
|
24
|
+
update-types:
|
|
25
|
+
- "minor"
|
|
26
|
+
- "patch"
|
|
27
|
+
|
|
28
|
+
# GitHub Actions
|
|
29
|
+
- package-ecosystem: "github-actions"
|
|
30
|
+
directory: "/"
|
|
31
|
+
schedule:
|
|
32
|
+
interval: "weekly"
|
|
33
|
+
day: "monday"
|
|
34
|
+
time: "09:00"
|
|
35
|
+
timezone: "UTC"
|
|
36
|
+
open-pull-requests-limit: 5
|
|
37
|
+
reviewers:
|
|
38
|
+
- "bellini666"
|
|
39
|
+
labels:
|
|
40
|
+
- "dependencies"
|
|
41
|
+
- "github-actions"
|
|
42
|
+
commit-message:
|
|
43
|
+
prefix: "ci"
|
|
44
|
+
include: "scope"
|
|
@@ -30,7 +30,7 @@ jobs:
|
|
|
30
30
|
sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
|
|
31
31
|
manylinux: auto
|
|
32
32
|
- name: Upload wheels
|
|
33
|
-
uses: actions/upload-artifact@
|
|
33
|
+
uses: actions/upload-artifact@v5
|
|
34
34
|
with:
|
|
35
35
|
name: wheels-linux-${{ matrix.target }}
|
|
36
36
|
path: dist
|
|
@@ -54,7 +54,7 @@ jobs:
|
|
|
54
54
|
sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
|
|
55
55
|
manylinux: musllinux_1_2
|
|
56
56
|
- name: Upload wheels
|
|
57
|
-
uses: actions/upload-artifact@
|
|
57
|
+
uses: actions/upload-artifact@v5
|
|
58
58
|
with:
|
|
59
59
|
name: wheels-musllinux-${{ matrix.target }}
|
|
60
60
|
path: dist
|
|
@@ -83,7 +83,7 @@ jobs:
|
|
|
83
83
|
args: --release --out dist --interpreter 3.10 3.11 3.12 3.13 3.14
|
|
84
84
|
sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
|
|
85
85
|
- name: Upload wheels
|
|
86
|
-
uses: actions/upload-artifact@
|
|
86
|
+
uses: actions/upload-artifact@v5
|
|
87
87
|
with:
|
|
88
88
|
name: wheels-windows-${{ matrix.target }}
|
|
89
89
|
path: dist
|
|
@@ -107,7 +107,7 @@ jobs:
|
|
|
107
107
|
args: --release --out dist --interpreter 3.14t
|
|
108
108
|
sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
|
|
109
109
|
- name: Upload wheels
|
|
110
|
-
uses: actions/upload-artifact@
|
|
110
|
+
uses: actions/upload-artifact@v5
|
|
111
111
|
with:
|
|
112
112
|
name: wheels-windows-${{ matrix.target }}-freethreaded
|
|
113
113
|
path: dist
|
|
@@ -134,7 +134,7 @@ jobs:
|
|
|
134
134
|
args: --release --out dist --interpreter 3.10 3.11 3.12 3.13 3.14 3.14t pypy3.10 pypy3.11
|
|
135
135
|
sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
|
|
136
136
|
- name: Upload wheels
|
|
137
|
-
uses: actions/upload-artifact@
|
|
137
|
+
uses: actions/upload-artifact@v5
|
|
138
138
|
with:
|
|
139
139
|
name: wheels-macos-${{ matrix.target }}
|
|
140
140
|
path: dist
|
|
@@ -149,7 +149,7 @@ jobs:
|
|
|
149
149
|
command: sdist
|
|
150
150
|
args: --out dist
|
|
151
151
|
- name: Upload sdist
|
|
152
|
-
uses: actions/upload-artifact@
|
|
152
|
+
uses: actions/upload-artifact@v5
|
|
153
153
|
with:
|
|
154
154
|
name: wheels-sdist
|
|
155
155
|
path: dist
|
|
@@ -167,13 +167,13 @@ jobs:
|
|
|
167
167
|
- uses: actions/checkout@v4
|
|
168
168
|
|
|
169
169
|
- name: Download all artifacts
|
|
170
|
-
uses: actions/download-artifact@
|
|
170
|
+
uses: actions/download-artifact@v6
|
|
171
171
|
with:
|
|
172
172
|
pattern: wheels-*
|
|
173
173
|
path: wheels
|
|
174
174
|
|
|
175
175
|
- name: Generate artifact attestation
|
|
176
|
-
uses: actions/attest-build-provenance@
|
|
176
|
+
uses: actions/attest-build-provenance@v3
|
|
177
177
|
with:
|
|
178
178
|
subject-path: "wheels/*/*.whl"
|
|
179
179
|
|
|
@@ -0,0 +1,95 @@
|
|
|
1
|
+
name: Security Audit
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
branches: [master, main]
|
|
6
|
+
pull_request:
|
|
7
|
+
branches: [master, main]
|
|
8
|
+
schedule:
|
|
9
|
+
# Run security audit daily at 00:00 UTC
|
|
10
|
+
- cron: '0 0 * * *'
|
|
11
|
+
workflow_dispatch:
|
|
12
|
+
|
|
13
|
+
env:
|
|
14
|
+
CARGO_TERM_COLOR: always
|
|
15
|
+
|
|
16
|
+
jobs:
|
|
17
|
+
security-audit:
|
|
18
|
+
name: Security Audit
|
|
19
|
+
runs-on: ubuntu-latest
|
|
20
|
+
permissions:
|
|
21
|
+
contents: read
|
|
22
|
+
security-events: write
|
|
23
|
+
steps:
|
|
24
|
+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
|
|
25
|
+
|
|
26
|
+
- name: Install Rust
|
|
27
|
+
uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a # master
|
|
28
|
+
with:
|
|
29
|
+
toolchain: stable
|
|
30
|
+
|
|
31
|
+
- name: Cache cargo registry
|
|
32
|
+
uses: actions/cache@v4
|
|
33
|
+
with:
|
|
34
|
+
path: ~/.cargo/registry
|
|
35
|
+
key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
|
|
36
|
+
|
|
37
|
+
- name: Install cargo-audit
|
|
38
|
+
run: cargo install cargo-audit --locked
|
|
39
|
+
|
|
40
|
+
- name: Run cargo audit
|
|
41
|
+
run: cargo audit --json | tee audit-results.json
|
|
42
|
+
|
|
43
|
+
- name: Check for vulnerabilities
|
|
44
|
+
run: |
|
|
45
|
+
# Allow warnings (unmaintained crates), but fail on vulnerabilities
|
|
46
|
+
if cargo audit; then
|
|
47
|
+
echo "✅ No critical vulnerabilities found"
|
|
48
|
+
else
|
|
49
|
+
echo "❌ Vulnerabilities detected - see output above"
|
|
50
|
+
exit 1
|
|
51
|
+
fi
|
|
52
|
+
|
|
53
|
+
- name: Upload audit results
|
|
54
|
+
if: always()
|
|
55
|
+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
|
|
56
|
+
with:
|
|
57
|
+
name: security-audit-results
|
|
58
|
+
path: audit-results.json
|
|
59
|
+
|
|
60
|
+
cargo-deny:
|
|
61
|
+
name: Cargo Deny
|
|
62
|
+
runs-on: ubuntu-latest
|
|
63
|
+
permissions:
|
|
64
|
+
contents: read
|
|
65
|
+
steps:
|
|
66
|
+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
|
|
67
|
+
|
|
68
|
+
- name: Install Rust
|
|
69
|
+
uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a # master
|
|
70
|
+
with:
|
|
71
|
+
toolchain: stable
|
|
72
|
+
|
|
73
|
+
- name: Run cargo deny
|
|
74
|
+
uses: EmbarkStudios/cargo-deny-action@f2ba7abc2abebaf185c833c3961145a3c275caad # v2.0.13
|
|
75
|
+
with:
|
|
76
|
+
log-level: warn
|
|
77
|
+
command: check
|
|
78
|
+
arguments: --all-features
|
|
79
|
+
|
|
80
|
+
dependency-review:
|
|
81
|
+
name: Dependency Review
|
|
82
|
+
runs-on: ubuntu-latest
|
|
83
|
+
if: github.event_name == 'pull_request'
|
|
84
|
+
permissions:
|
|
85
|
+
contents: read
|
|
86
|
+
pull-requests: write
|
|
87
|
+
steps:
|
|
88
|
+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
|
|
89
|
+
|
|
90
|
+
- name: Dependency Review
|
|
91
|
+
uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
|
|
92
|
+
with:
|
|
93
|
+
fail-on-severity: moderate
|
|
94
|
+
deny-licenses: GPL-3.0, LGPL-3.0, AGPL-3.0
|
|
95
|
+
comment-summary-in-pr: always
|
|
@@ -26,6 +26,22 @@ repos:
|
|
|
26
26
|
types: [rust]
|
|
27
27
|
pass_filenames: false
|
|
28
28
|
|
|
29
|
+
- id: cargo-audit
|
|
30
|
+
name: cargo audit (security)
|
|
31
|
+
entry: cargo audit
|
|
32
|
+
language: system
|
|
33
|
+
types: [rust]
|
|
34
|
+
pass_filenames: false
|
|
35
|
+
stages: [pre-push]
|
|
36
|
+
|
|
37
|
+
- id: cargo-deny
|
|
38
|
+
name: cargo deny (licenses & security)
|
|
39
|
+
entry: cargo deny check
|
|
40
|
+
language: system
|
|
41
|
+
types: [rust]
|
|
42
|
+
pass_filenames: false
|
|
43
|
+
stages: [pre-push]
|
|
44
|
+
|
|
29
45
|
# General file checks
|
|
30
46
|
- repo: https://github.com/pre-commit/pre-commit-hooks
|
|
31
47
|
rev: v5.0.0
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: pytest-language-server
|
|
3
|
-
Version: 0.3.
|
|
3
|
+
Version: 0.3.1
|
|
4
4
|
Classifier: Development Status :: 4 - Beta
|
|
5
5
|
Classifier: Intended Audience :: Developers
|
|
6
6
|
Classifier: License :: OSI Approved :: MIT License
|
|
@@ -9,6 +9,7 @@ Classifier: Programming Language :: Python :: 3.10
|
|
|
9
9
|
Classifier: Programming Language :: Python :: 3.11
|
|
10
10
|
Classifier: Programming Language :: Python :: 3.12
|
|
11
11
|
Classifier: Programming Language :: Python :: 3.13
|
|
12
|
+
Classifier: Programming Language :: Python :: 3.14
|
|
12
13
|
Classifier: Programming Language :: Rust
|
|
13
14
|
Classifier: Topic :: Software Development :: Testing
|
|
14
15
|
Classifier: Topic :: Software Development :: Libraries
|
|
@@ -25,6 +26,14 @@ Project-URL: Issues, https://github.com/bellini666/pytest-language-server/issues
|
|
|
25
26
|
|
|
26
27
|
# pytest-language-server 🔥
|
|
27
28
|
|
|
29
|
+
[](https://github.com/bellini666/pytest-language-server/actions/workflows/ci.yml)
|
|
30
|
+
[](https://github.com/bellini666/pytest-language-server/actions/workflows/security.yml)
|
|
31
|
+
[](https://badge.fury.io/py/pytest-language-server)
|
|
32
|
+
[](https://pepy.tech/project/pytest-language-server)
|
|
33
|
+
[](https://crates.io/crates/pytest-language-server)
|
|
34
|
+
[](https://opensource.org/licenses/MIT)
|
|
35
|
+
[](https://pypi.org/project/pytest-language-server/)
|
|
36
|
+
|
|
28
37
|
> **Shamelessly vibed into existence** 🤖✨
|
|
29
38
|
>
|
|
30
39
|
> This entire LSP implementation was built from scratch in a single AI-assisted coding session.
|
|
@@ -139,6 +148,18 @@ require'lspconfig'.pytest_lsp.setup{
|
|
|
139
148
|
}
|
|
140
149
|
```
|
|
141
150
|
|
|
151
|
+
### Zed
|
|
152
|
+
|
|
153
|
+
Install the extension from the extensions marketplace:
|
|
154
|
+
|
|
155
|
+
1. Open Zed
|
|
156
|
+
2. Open the command palette (Cmd+Shift+P / Ctrl+Shift+P)
|
|
157
|
+
3. Search for "zed: extensions"
|
|
158
|
+
4. Search for "pytest Language Server"
|
|
159
|
+
5. Click "Install"
|
|
160
|
+
|
|
161
|
+
The extension will automatically detect `pytest-language-server` if it's in your PATH.
|
|
162
|
+
|
|
142
163
|
### VS Code
|
|
143
164
|
|
|
144
165
|
Install the extension from the marketplace (coming soon) or configure manually:
|
|
@@ -265,10 +286,35 @@ cargo test
|
|
|
265
286
|
RUST_LOG=debug cargo run
|
|
266
287
|
```
|
|
267
288
|
|
|
289
|
+
## Security
|
|
290
|
+
|
|
291
|
+
Security is a priority. This project includes:
|
|
292
|
+
- Automated dependency vulnerability scanning (cargo-audit)
|
|
293
|
+
- License compliance checking (cargo-deny)
|
|
294
|
+
- Daily security audits in CI/CD
|
|
295
|
+
- Dependency review on pull requests
|
|
296
|
+
- Pre-commit security hooks
|
|
297
|
+
|
|
298
|
+
See [SECURITY.md](SECURITY.md) for our security policy and how to report vulnerabilities.
|
|
299
|
+
|
|
268
300
|
## Contributing
|
|
269
301
|
|
|
270
302
|
Contributions are welcome! Please feel free to submit a Pull Request.
|
|
271
303
|
|
|
304
|
+
### Development Setup
|
|
305
|
+
|
|
306
|
+
1. Install pre-commit hooks:
|
|
307
|
+
```bash
|
|
308
|
+
pre-commit install
|
|
309
|
+
```
|
|
310
|
+
|
|
311
|
+
2. Run security checks locally:
|
|
312
|
+
```bash
|
|
313
|
+
cargo audit
|
|
314
|
+
cargo clippy
|
|
315
|
+
cargo test
|
|
316
|
+
```
|
|
317
|
+
|
|
272
318
|
## License
|
|
273
319
|
|
|
274
320
|
MIT License - see LICENSE file for details.
|
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# pytest-language-server 🔥
|
|
2
2
|
|
|
3
|
+
[](https://github.com/bellini666/pytest-language-server/actions/workflows/ci.yml)
|
|
4
|
+
[](https://github.com/bellini666/pytest-language-server/actions/workflows/security.yml)
|
|
5
|
+
[](https://badge.fury.io/py/pytest-language-server)
|
|
6
|
+
[](https://pepy.tech/project/pytest-language-server)
|
|
7
|
+
[](https://crates.io/crates/pytest-language-server)
|
|
8
|
+
[](https://opensource.org/licenses/MIT)
|
|
9
|
+
[](https://pypi.org/project/pytest-language-server/)
|
|
10
|
+
|
|
3
11
|
> **Shamelessly vibed into existence** 🤖✨
|
|
4
12
|
>
|
|
5
13
|
> This entire LSP implementation was built from scratch in a single AI-assisted coding session.
|
|
@@ -114,6 +122,18 @@ require'lspconfig'.pytest_lsp.setup{
|
|
|
114
122
|
}
|
|
115
123
|
```
|
|
116
124
|
|
|
125
|
+
### Zed
|
|
126
|
+
|
|
127
|
+
Install the extension from the extensions marketplace:
|
|
128
|
+
|
|
129
|
+
1. Open Zed
|
|
130
|
+
2. Open the command palette (Cmd+Shift+P / Ctrl+Shift+P)
|
|
131
|
+
3. Search for "zed: extensions"
|
|
132
|
+
4. Search for "pytest Language Server"
|
|
133
|
+
5. Click "Install"
|
|
134
|
+
|
|
135
|
+
The extension will automatically detect `pytest-language-server` if it's in your PATH.
|
|
136
|
+
|
|
117
137
|
### VS Code
|
|
118
138
|
|
|
119
139
|
Install the extension from the marketplace (coming soon) or configure manually:
|
|
@@ -240,10 +260,35 @@ cargo test
|
|
|
240
260
|
RUST_LOG=debug cargo run
|
|
241
261
|
```
|
|
242
262
|
|
|
263
|
+
## Security
|
|
264
|
+
|
|
265
|
+
Security is a priority. This project includes:
|
|
266
|
+
- Automated dependency vulnerability scanning (cargo-audit)
|
|
267
|
+
- License compliance checking (cargo-deny)
|
|
268
|
+
- Daily security audits in CI/CD
|
|
269
|
+
- Dependency review on pull requests
|
|
270
|
+
- Pre-commit security hooks
|
|
271
|
+
|
|
272
|
+
See [SECURITY.md](SECURITY.md) for our security policy and how to report vulnerabilities.
|
|
273
|
+
|
|
243
274
|
## Contributing
|
|
244
275
|
|
|
245
276
|
Contributions are welcome! Please feel free to submit a Pull Request.
|
|
246
277
|
|
|
278
|
+
### Development Setup
|
|
279
|
+
|
|
280
|
+
1. Install pre-commit hooks:
|
|
281
|
+
```bash
|
|
282
|
+
pre-commit install
|
|
283
|
+
```
|
|
284
|
+
|
|
285
|
+
2. Run security checks locally:
|
|
286
|
+
```bash
|
|
287
|
+
cargo audit
|
|
288
|
+
cargo clippy
|
|
289
|
+
cargo test
|
|
290
|
+
```
|
|
291
|
+
|
|
247
292
|
## License
|
|
248
293
|
|
|
249
294
|
MIT License - see LICENSE file for details.
|
|
@@ -0,0 +1,131 @@
|
|
|
1
|
+
# Security Policy
|
|
2
|
+
|
|
3
|
+
## Supported Versions
|
|
4
|
+
|
|
5
|
+
We release security updates for the following versions:
|
|
6
|
+
|
|
7
|
+
| Version | Supported |
|
|
8
|
+
| ------- | ------------------ |
|
|
9
|
+
| 0.3.x | :white_check_mark: |
|
|
10
|
+
| < 0.3 | :x: |
|
|
11
|
+
|
|
12
|
+
## Reporting a Vulnerability
|
|
13
|
+
|
|
14
|
+
We take the security of pytest-language-server seriously. If you believe you have found a security vulnerability, please report it to us as described below.
|
|
15
|
+
|
|
16
|
+
### How to Report
|
|
17
|
+
|
|
18
|
+
**Please do NOT report security vulnerabilities through public GitHub issues.**
|
|
19
|
+
|
|
20
|
+
Instead, please report them via email to:
|
|
21
|
+
|
|
22
|
+
- **Email**: hackedbellini@gmail.com
|
|
23
|
+
- **Subject**: [SECURITY] pytest-language-server vulnerability report
|
|
24
|
+
|
|
25
|
+
Please include the following information in your report:
|
|
26
|
+
|
|
27
|
+
- Type of vulnerability
|
|
28
|
+
- Full paths of source file(s) related to the manifestation of the issue
|
|
29
|
+
- The location of the affected source code (tag/branch/commit or direct URL)
|
|
30
|
+
- Any special configuration required to reproduce the issue
|
|
31
|
+
- Step-by-step instructions to reproduce the issue
|
|
32
|
+
- Proof-of-concept or exploit code (if possible)
|
|
33
|
+
- Impact of the issue, including how an attacker might exploit it
|
|
34
|
+
|
|
35
|
+
### What to Expect
|
|
36
|
+
|
|
37
|
+
- **Acknowledgment**: We will acknowledge receipt of your vulnerability report within 48 hours.
|
|
38
|
+
- **Updates**: We will send you regular updates about our progress, at minimum every 7 days.
|
|
39
|
+
- **Disclosure Timeline**: We aim to disclose vulnerabilities within 90 days of the initial report.
|
|
40
|
+
- **Credit**: We will credit you in the security advisory unless you prefer to remain anonymous.
|
|
41
|
+
|
|
42
|
+
### Security Update Process
|
|
43
|
+
|
|
44
|
+
1. The security team will investigate and validate the vulnerability
|
|
45
|
+
2. A fix will be developed in a private repository
|
|
46
|
+
3. A new version will be released with the fix
|
|
47
|
+
4. A security advisory will be published on GitHub
|
|
48
|
+
5. The CVE (if applicable) will be requested and published
|
|
49
|
+
|
|
50
|
+
## Security Best Practices for Users
|
|
51
|
+
|
|
52
|
+
### Installation
|
|
53
|
+
|
|
54
|
+
- Always install from official sources (PyPI, Homebrew, or crates.io)
|
|
55
|
+
- Verify checksums when downloading pre-built binaries
|
|
56
|
+
- Use the latest stable version
|
|
57
|
+
|
|
58
|
+
### Running the Server
|
|
59
|
+
|
|
60
|
+
- Run the LSP server with the minimum required privileges
|
|
61
|
+
- Do not expose the LSP server to untrusted networks
|
|
62
|
+
- Be cautious when opening untrusted workspace directories
|
|
63
|
+
- Review the workspace before allowing the server to scan it
|
|
64
|
+
|
|
65
|
+
### Known Limitations
|
|
66
|
+
|
|
67
|
+
- The server scans all Python files in the workspace recursively
|
|
68
|
+
- The server reads contents of test files and conftest.py files
|
|
69
|
+
- The server may follow symlinks in the workspace
|
|
70
|
+
- Virtual environment scanning may access third-party code
|
|
71
|
+
|
|
72
|
+
## Security Measures
|
|
73
|
+
|
|
74
|
+
### Development
|
|
75
|
+
|
|
76
|
+
- All code changes are reviewed before merging
|
|
77
|
+
- We use automated security scanning in CI/CD:
|
|
78
|
+
- `cargo audit` for known vulnerabilities
|
|
79
|
+
- `cargo deny` for license compliance and security policies
|
|
80
|
+
- `cargo clippy` for code quality and potential issues
|
|
81
|
+
- Dependency review on pull requests
|
|
82
|
+
- GitHub Actions are pinned to specific commit SHAs
|
|
83
|
+
- We use GitHub's security features (Dependabot, security advisories)
|
|
84
|
+
|
|
85
|
+
### Build Process
|
|
86
|
+
|
|
87
|
+
- Builds are reproducible via Cargo.lock
|
|
88
|
+
- Release artifacts include build provenance attestations
|
|
89
|
+
- PyPI releases use trusted publishing with OIDC
|
|
90
|
+
|
|
91
|
+
### Dependencies
|
|
92
|
+
|
|
93
|
+
- We minimize the dependency tree
|
|
94
|
+
- Dependencies are regularly updated
|
|
95
|
+
- Unmaintained dependencies are monitored and replaced when necessary
|
|
96
|
+
|
|
97
|
+
## Security Auditing
|
|
98
|
+
|
|
99
|
+
We perform regular security audits:
|
|
100
|
+
|
|
101
|
+
- **Daily**: Automated dependency vulnerability scanning
|
|
102
|
+
- **Weekly**: Manual review of security alerts
|
|
103
|
+
- **Per Release**: Full security review before each release
|
|
104
|
+
|
|
105
|
+
## Responsible Disclosure
|
|
106
|
+
|
|
107
|
+
We believe in responsible disclosure and will work with security researchers to:
|
|
108
|
+
|
|
109
|
+
- Understand and reproduce the vulnerability
|
|
110
|
+
- Develop and test a fix
|
|
111
|
+
- Coordinate disclosure timing
|
|
112
|
+
- Provide credit in security advisories
|
|
113
|
+
|
|
114
|
+
## Contact
|
|
115
|
+
|
|
116
|
+
For security-related questions or concerns that do not relate to a vulnerability, you can:
|
|
117
|
+
|
|
118
|
+
- Open a GitHub discussion (for general security questions)
|
|
119
|
+
- Email: hackedbellini@gmail.com (for sensitive matters)
|
|
120
|
+
|
|
121
|
+
## Hall of Fame
|
|
122
|
+
|
|
123
|
+
We thank the following researchers for responsibly disclosing security issues:
|
|
124
|
+
|
|
125
|
+
<!-- This section will be updated as researchers report vulnerabilities -->
|
|
126
|
+
|
|
127
|
+
*No vulnerabilities reported yet. Be the first!*
|
|
128
|
+
|
|
129
|
+
---
|
|
130
|
+
|
|
131
|
+
**Last Updated**: 2025-01-15
|
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
#!/bin/bash
|
|
2
|
+
# Version bump script for pytest-language-server
|
|
3
|
+
# Usage: ./bump-version.sh <new-version>
|
|
4
|
+
# Example: ./bump-version.sh 0.3.1
|
|
5
|
+
|
|
6
|
+
set -e
|
|
7
|
+
|
|
8
|
+
if [ -z "$1" ]; then
|
|
9
|
+
echo "Usage: $0 <new-version>"
|
|
10
|
+
echo "Example: $0 0.3.1"
|
|
11
|
+
exit 1
|
|
12
|
+
fi
|
|
13
|
+
|
|
14
|
+
NEW_VERSION="$1"
|
|
15
|
+
|
|
16
|
+
# Validate version format (basic semver check)
|
|
17
|
+
if ! echo "$NEW_VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
|
|
18
|
+
echo "Error: Version must be in format X.Y.Z (e.g., 0.3.1)"
|
|
19
|
+
exit 1
|
|
20
|
+
fi
|
|
21
|
+
|
|
22
|
+
echo "Bumping version to $NEW_VERSION..."
|
|
23
|
+
|
|
24
|
+
# Update Cargo.toml
|
|
25
|
+
sed -i.bak "s/^version = \".*\"/version = \"$NEW_VERSION\"/" Cargo.toml && rm Cargo.toml.bak
|
|
26
|
+
|
|
27
|
+
# Update pyproject.toml
|
|
28
|
+
sed -i.bak "s/^version = \".*\"/version = \"$NEW_VERSION\"/" pyproject.toml && rm pyproject.toml.bak
|
|
29
|
+
|
|
30
|
+
# Update zed-extension/Cargo.toml
|
|
31
|
+
sed -i.bak "s/^version = \".*\"/version = \"$NEW_VERSION\"/" zed-extension/Cargo.toml && rm zed-extension/Cargo.toml.bak
|
|
32
|
+
|
|
33
|
+
# Update zed-extension/extension.toml
|
|
34
|
+
sed -i.bak "s/^version = \".*\"/version = \"$NEW_VERSION\"/" zed-extension/extension.toml && rm zed-extension/extension.toml.bak
|
|
35
|
+
|
|
36
|
+
# Update Cargo.lock
|
|
37
|
+
cargo update -p pytest-language-server
|
|
38
|
+
|
|
39
|
+
echo "✓ Version bumped to $NEW_VERSION in:"
|
|
40
|
+
echo " - Cargo.toml"
|
|
41
|
+
echo " - pyproject.toml"
|
|
42
|
+
echo " - zed-extension/Cargo.toml"
|
|
43
|
+
echo " - zed-extension/extension.toml"
|
|
44
|
+
echo " - Cargo.lock"
|
|
45
|
+
echo ""
|
|
46
|
+
echo "Run 'git add -A && git commit -m \"chore: bump version to $NEW_VERSION\"' to commit"
|
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
# Configuration for cargo-deny
|
|
2
|
+
# https://embarkstudios.github.io/cargo-deny/
|
|
3
|
+
|
|
4
|
+
[advisories]
|
|
5
|
+
# Ignore unmaintained advisories for dependencies we can't easily replace
|
|
6
|
+
ignore = [
|
|
7
|
+
"RUSTSEC-2024-0436", # paste - unmaintained (used by rustpython-parser)
|
|
8
|
+
"RUSTSEC-2025-0075", # unic-char-range - unmaintained
|
|
9
|
+
"RUSTSEC-2025-0080", # unic-common - unmaintained
|
|
10
|
+
"RUSTSEC-2025-0081", # unic-char-property - unmaintained
|
|
11
|
+
"RUSTSEC-2025-0090", # unic-emoji-char - unmaintained
|
|
12
|
+
"RUSTSEC-2025-0098", # unic-ucd-version - unmaintained
|
|
13
|
+
"RUSTSEC-2025-0100", # unic-ucd-ident - unmaintained
|
|
14
|
+
]
|
|
15
|
+
# Warn about yanked crates but don't fail
|
|
16
|
+
yanked = "warn"
|
|
17
|
+
|
|
18
|
+
[licenses]
|
|
19
|
+
# Allow these licenses
|
|
20
|
+
allow = [
|
|
21
|
+
"MIT",
|
|
22
|
+
"Apache-2.0",
|
|
23
|
+
"Apache-2.0 WITH LLVM-exception",
|
|
24
|
+
"BSD-2-Clause",
|
|
25
|
+
"BSD-3-Clause",
|
|
26
|
+
"ISC",
|
|
27
|
+
"Unicode-DFS-2016",
|
|
28
|
+
"Unicode-3.0", # Used by ICU crates for Unicode data
|
|
29
|
+
"CC0-1.0",
|
|
30
|
+
"0BSD",
|
|
31
|
+
"Zlib",
|
|
32
|
+
"MPL-2.0",
|
|
33
|
+
"LGPL-3.0-only", # Used by malachite (via rustpython-parser)
|
|
34
|
+
]
|
|
35
|
+
|
|
36
|
+
# Confidence threshold for license detection
|
|
37
|
+
confidence-threshold = 0.8
|
|
38
|
+
|
|
39
|
+
[bans]
|
|
40
|
+
# Lint level for when multiple versions of the same crate are detected
|
|
41
|
+
multiple-versions = "warn"
|
|
42
|
+
# Allow wildcard dependencies
|
|
43
|
+
wildcards = "allow"
|
|
44
|
+
# Deny these specific crates (empty for now)
|
|
45
|
+
deny = []
|
|
46
|
+
|
|
47
|
+
[sources]
|
|
48
|
+
# Ensure all dependencies come from trusted sources
|
|
49
|
+
unknown-registry = "deny"
|
|
50
|
+
unknown-git = "deny"
|
|
51
|
+
|
|
52
|
+
[sources.allow-org]
|
|
53
|
+
github = []
|
|
@@ -4,7 +4,7 @@ build-backend = "maturin"
|
|
|
4
4
|
|
|
5
5
|
[project]
|
|
6
6
|
name = "pytest-language-server"
|
|
7
|
-
version = "0.3.
|
|
7
|
+
version = "0.3.1"
|
|
8
8
|
description = "A blazingly fast Language Server Protocol implementation for pytest"
|
|
9
9
|
authors = [{name = "Thiago Bellini Ribeiro", email = "hackedbellini@gmail.com"}]
|
|
10
10
|
readme = "README.md"
|
|
@@ -19,6 +19,7 @@ classifiers = [
|
|
|
19
19
|
"Programming Language :: Python :: 3.11",
|
|
20
20
|
"Programming Language :: Python :: 3.12",
|
|
21
21
|
"Programming Language :: Python :: 3.13",
|
|
22
|
+
"Programming Language :: Python :: 3.14",
|
|
22
23
|
"Programming Language :: Rust",
|
|
23
24
|
"Topic :: Software Development :: Testing",
|
|
24
25
|
"Topic :: Software Development :: Libraries",
|
|
File without changes
|
|
File without changes
|
{pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/Formula/pytest-language-server.rb
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/tests/test_project/conftest.py
RENAMED
|
File without changes
|
{pytest_language_server-0.3.0 → pytest_language_server-0.3.1}/tests/test_project/test_example.py
RENAMED
|
File without changes
|
|
File without changes
|