-
-
Notifications
You must be signed in to change notification settings - Fork 683
Description
Describe the bug
Since #1212, any configuration that still defines skips = B320,B410
fails to run with the message:
[main] INFO cli exclude tests: B320,B410
[main] ERROR Unknown test found in profile: B320
While it is fine if those checks are not needed anymore in more recent versions of bandit
, the configuration should be lenient about skipping unknown codes that are meant to be ignored anyway.
The reason why this is relevant is that different versions of bandit
might be in use, and leaving in codes that were historically ignored allows more seamless use of the tool between those versions. If, for whatever reason, the tool must be kept to an older version somewhere, removing the deprecated code would break the configuration. This forces maintenance of multiple configuration files across locations, which is more error-prone.
Reproduction steps
1. set `skips = B320,B410` in the configuration
2. run a prior version `bandit<1.8.1`, everything works on a given project
3. run a version `bandit>=1.8.1`, the tool complains about unknown configuration
...
Expected behavior
Silently ignore unknown codes that are meant to be skipped anyway.
The default behavior could be to act as bandit
currently does, but provide a mode = lenient
or similar to simply warn about those cases rather than fail execution.
Bandit version
1.8.1 (note: PR dropdown doesn't let us select >1.8.0
here, needed manual edit)
Python version
3.12
Additional context
No response