PyPI - secure-code-agent - Versions diffs - 0.11.0__tar.gz → 0.11.1__tar.gz - Mend

@@ -400,6 +400,19 @@ def _do_audit(args: argparse.Namespace) -> int:
     root_for_tests = target if target.is_dir() else target.parent
     def _classify(finding: Finding) -> str:
+        # A dependency advisory is about the dependency, not about the file
+        # that happened to declare it. Classified by category before path,
+        # because the path routing gets it wrong: `requirements.txt` matches
+        # the documentation pattern `**/*.txt`, so every CVE in a pip
+        # manifest was filed under **documentation** — eighteen of them on a
+        # six-file demo tree. A dependency finding is not documentation
+        # whatever the manifest is called.
+        #
+        # Returning "primary" hands it to `split_side_axes` below, which is
+        # what moves it onto the dependencies axis. Neither axis is scored,
+        # so this changes where a finding is *reported*, not the grade.
+        if finding.category is Category.DEPENDENCIES:
+            return "primary"
         if is_test_path(finding.file_path, root_for_tests, cfg.test_patterns):
             return "test tree"
         if is_test_path(finding.file_path, root_for_tests, cfg.docs_patterns):

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.11.0
+Version: 0.11.1
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -470,7 +470,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.11.0
+- uses: marshallguillory86/secure-code-agent@v0.11.1
   with:
     config: secure-code-agent.json
     fail-on-gate: true

@@ -424,7 +424,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.11.0
+- uses: marshallguillory86/secure-code-agent@v0.11.1
   with:
     config: secure-code-agent.json
     fail-on-gate: true

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.11.0
+Version: 0.11.1
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -470,7 +470,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.11.0
+- uses: marshallguillory86/secure-code-agent@v0.11.1
   with:
     config: secure-code-agent.json
     fail-on-gate: true

@@ -12,4 +12,4 @@
 #:
 #: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
 #: artifacts name their own producer correctly.
-__version__ = "0.11.0"
+__version__ = "0.11.1"

@@ -101,11 +101,11 @@ def build(destination: Path | None = None) -> Path:
     (root / "README.md").write_text(README, encoding="utf-8")
     # No dependency manifest. A pinned-vulnerable `requirements.txt` was here
     # and it made the demo worse, not better: eighteen pip-audit CVEs drowned
-    # the seven code defects the demo exists to show. It also surfaced a
-    # separate defect worth its own fix — those CVEs were filed on the
-    # **documentation** axis, because the manifest is a `.txt` file and the
-    # axis split reads the extension. A dependency finding is not
-    # documentation whatever the manifest is called.
+    # the seven code defects the demo exists to show.
+    #
+    # It also surfaced a real defect, since fixed: those CVEs were filed on
+    # the **documentation** axis, because the manifest is a `.txt` file and
+    # the axis split read the extension before the category.
     return root

secure-code-agent 0.11.0__tar.gz → 0.11.1__tar.gz