Change Log

Change Log#

Change Log#

Version 1.8.1:#

Added

  • Dashboard: Updated info text on Dashboard version.

  • Updated secrets list for egress scanning.

Changed

  • Reporting (WASM version): Updated imported modules display logic—submodules and private modules are now hidden so that only real imported external modules are shown.

Fixed

  • Reporting (WASM version): Resolved an error in the imported modules.

Documentation

  • Improved API documentation.

  • Various minor improvements.

Version 1.8.0:#

Added

  • Security Checks: Added checks for importlib.util.spec_from_file_location and importlib.util.module_from_spec to mitigate recent CVE-2026-40156 vulnerabilities.

  • Configuration: Added [tool.pytest] section to pyproject.toml.

Changed

  • CLD Output for checks overview: Sorted the codeaudit checks output now alphabetically by Name.

  • Security: Updated the secret list used for egress detection.

Fixed

  • Configuration: Added the missing homepage field under [project.urls] in pyproject.toml.

Documentation

  • CLI Help: Added help documentation for the CI command (cimode). Big thanks to @jurgenwigg for pull request #25!

Version 1.7.1:#

Added

  • PyPI Update Indicator: Added an indicator for the last update of PyPI packages, implemented for both the CLI version and the Dashboard version.

  • Test Coverage: Added extra tests to improve codebase stability.

  • Dashboard Overview (WASM version): The total number of weaknesses is now displayed directly in the overview tab.

Changed

  • CLI Report Optimization (Modules): The CLI report now only displays modules when they are actually found.

  • CLI Report Optimization (Tips): The CLI report now only displays the tip to check external modules for vulnerabilities if vulnerabilities are actually present in a file.

Fixed

  • Windows 11 Compatibility: Fixed an issue to ensure codeaudit overview works properly on Windows 11, specifically resolving a bug in the count_lines_iterate function.

  • Altair Visuals: Fixed stability issues with the Altair Visual overview in the codeaudit overview section, making it stable again.

Documentation

  • General documentation updates and minor fixes.

Version 1.7.0:#

Added

  • CI Option: Added a new Continuous Integration (CI) option. (See issue #24)

Documentation

  • Fixes & Updates: Minor documentation fixes and content updates.

Version 1.6.6:#

Added:

  • Extended checking capabilities for Base64 encoding to improve validation rigor.

Changed

  • Updated pyproject.toml configuration to align with the new WebAssembly (WASM) release requirements.

Fixed

  • Resolved compatibility issues and bugs to fully support the new stable WASM version.

Documentation

  • Miscellaneous documentation improvements and updates for clarity and coverage.

Version 1.6.5:#

Added:

  • Plain FTP Validation: Introduced a new validation check to detect the use of plain FTP. Using FTP in modern Python applications is considered a significant security risk (red flag).

Changed:

  • Version Retrieval: Reverted the change that retrieved package versions from PyPI (originally introduced in PR #16) due to compatibility issues with WASM.

  • CI/CD Configuration: Updated pyproject.toml to enhance GitHub Actions testing workflows. (Credit: @jurgenwigg)

Fixed:

  • Docstring Improvements: Enhanced and refined docstrings across the Altair APIs for better clarity and developer experience.

Documentation:

  • Manual Update: Substantial improvements to the user manual, including a new section dedicated to integrating and using Python security validation tools.

Version 1.6.4:#

Fixed:

  • Dashboard Reporting: Resolved issue affecting dashboard rendering and data output within the Panel / WASM (WebAssembly) environment.

Version 1.6.3:#

🚀 Added

  • WASM Test Drive: Updated documentation to highlight the WebAssembly (WASM) version, allowing users to test-drive the tool directly in the browser without local installation.

  • Enhanced FileScan API: The filescan API now returns detailed results on found weaknesses, matching the comprehensive output of the CLI version.

🛠️ Changed

  • API Refactoring: Extensive refactoring of API functions for better modularity and performance.

  • Version Retrieval: Improved the logic for retrieving version information. Special thanks to @jurgenwigg (#PR16).

🐞 Fixed

  • Dashboard Reporting: Squashed bugs and improved the reliability of the dashboard reporting APIs.

  • Project Metadata: Implemented fixes and improvements for pyproject.toml configuration.

📝 Documentation

  • Updated README.md with link to the WASM-based demonstration.

Version 1.6.2:#

Added

  • Automated Python Testing: Implemented automation for testing across various Python versions to ensure cross-version compatibility.

Changed

  • Internal Logic Improvements: Enhanced the count_privacy_check_results function to provide more robust egress count testing.

  • CLI Reporting: Updated the command-line interface to dynamically toggle between “issue” (singular) and “issues” (plural) based on the findings.

  • Architecture Refactoring: Refined internal logic for increased stability and to ensure the codebase is WASM ready.

  • License Standardization: Updated the GPLv3 license banner across key Python files for stylistic consistency. (see also issue #4)

Fixed

  • Issue #6 (Defensive Coding): Resolved KeyError and syntax error during code snippet creation through more defensive programming practices.

Documentation

  • Typos fixed and various improvements.

Version 1.6.1:#

Added Data Exfiltration Logic: Introduced improved and refactored logic for data egress (data exfiltration) risk detection.

False Positive Prevention: Updated the secretlist to prevent false positives associated with common class definitions and NLP modules.

Changed API Robustness: Performed minor code refactoring to ensure error handling is more robust when interacting with APIs.

Maintenance Refactor: Renamed several functions to ensure the codebase remains simple, intuitive, and easy to maintain.

Project Branding: Updated the PyPI.org description to more accurately reflect the tool’s core purpose and capabilities.

Fixed Logic Refinement: Refined the data egress detection scripts to improve accuracy and performance.

Documentation Report Clarity: Improved the HTML filescan report text to clarify that external egress detection is distinct from identifying secrets within Python code.

General Maintenance: Applied various fixes and improvements to the project documentation for better readability.

Version 1.6.0:#

Added:

  • Option to suppress security weaknesses in files that have a marker, like #nosec. Available for both CLI and API functions.

  • Extra check for use of subprocess methods: subprocess.check_call, subprocess.check_output, subprocess.getoutput and subprocess.getstatusoutput

Changed:

  • Variable name updated to prevent false positives in secrets scan for egress risk.

  • Renamed API function get_construct_counts to get_weakness_counts to better reflect its purpose. This API function now also supports suppressing weaknesses that are marked.

Fixed:

  • Gracefully catch errors when the directory for a custom output report does not exist. Python Code Audit will not create directories due to security constraints.

Documentation:

  • Various text fixes and improvements in the manual.

Version 1.5.0:#

Added:

  • External Egress Risk Detection: New functionality to identify potential API keys or logic used for connecting to remote services. Reports now include the specific line and “keyword” associated with the identified risk. Note: External Egress Risk Detection is still experimental and in beta status! Help improve it!.

Changed:

  • CLI HTML Reporting: Refined the reporting output for single file scans. Users will now see a clear, dedicated line when no security weaknesses are found.

  • UI/UX Enhancements: Applied “Look & Feel” improvements across all HTML report templates for better readability and aesthetics.

  • General CLI Polish: Improved various text strings throughout the Command Line Interface for better clarity.

Fixed:

  • Error Messaging: Improved the descriptiveness and clarity of CLI error messages to assist in troubleshooting.

Documentation:

  • Report Naming Conventions: Improved the titles of HTML reports. This ensures that when a user saves a report as a PDF via a browser, the default filename is more descriptive and professional.

Version 1.4.2: API updates and fixes#

Added:

  • Remote Package Scanning: The codeaudit.api_interfaces.filescan(input_path) function now supports PyPI.org packages directly. Users can scan packages by name without needing to clone the repository locally first.

Changed:

  • CLI Improvements: Refined the command-line interface (CLI) help text for better clarity and updated information.

Fixed:

  • Help Command Shortcut: Fixed an issue where the -? flag did not correctly trigger the help text. Running codeaudit [command] -? now displays the expected documentation.

Documentation:

  • Performed a manual updates to improve readability and technical accuracy.

Version 1.4.1: Bug fixes#

🚀 New Features & Enhancements

  • Remote PyPI Auditing: The codeaudit overview <directory|package> command now supports creating an overview from packages hosted on PyPI.org. Consequently, local cloning is no longer required!

🛠 Bug Fixes

  • Improved sdist Resilience: Enhanced error handling for scenarios where a package exists on PyPI but a source distribution (sdist) is unavailable.

📝 Documentation & UI Updates

  • CLI Improvements: Refined terminal text and messaging for better clarity during operation.

  • Manual Update: The user manual has been updated to reflect new command capabilities and workflows.

Version 1.4: Changes and Updates#

🚀 New Features and Enhancements Direct PyPI Package Scanning: You can now directly scan packages hosted on PyPI from the command line interface (CLI).

  • Usage: Use the existing codeaudit filescan command followed by the package name.

Example: codeaudit filescan [package_name]

Consult the documentation for full details.

  • HTML Report Text Improvement: The text content and clarity of the generated HTML reports have been enhanced for better readability.

🛡️ Security Validation Updates New Weakness Detection (Python 3.14+): Added a new validation rule to detect potential weaknesses when using the newly added compression.zstd module (available in Python 3.14 and later).

The scanner now specifically flags cases where compression.zstd is used for decompressing or opening a zstd compressed archive.

🐛 Bug Fixes and Documentation

  • Documentation Correction: Corrected and improved the help text for the API call get_construct_counts(). And many small improvements on the manual to assist you better with outlining risks on found weaknesses and possible mitigations.

Version 1.3: Changes and Updates#

  • Documentation: General improvements and clarifications.

  • Environment: Updated project.toml — now compatible with Python 3.14.

    • ⚠️ Note: The Altair dependency for Python 3.14 requires an update; final wording will depend on the release status of the next Altair version. The current working version of Altair (altair-5.6.0.dev0 with typing-extensions-4.15.0 ) was used to validate correct working of all functionality of Python Code Audit for Python 3.14.

  • Validation Enhancements:

    • Added validation for use of the class pickle.Unpickler, which may process untrusted binary pickle data streams.

    • Added validation for use of the class shelve.DbfilenameShelf.

    • Extended validation to detect potentially unsafe calls to the random module.

  • CLI: Improved help text for the cld command.

Version 1.2: Changes and Updates#

  • fix: Improved error handling — when performing a file scan on a single Python file that cannot be parsed, the CLI now correctly displays an error message.

  • fix: Updated API logic to properly handle parsing errors for single Python files.

  • fix: Corrected validation descriptions for os.write and os.writev. Writing to unvalidated or unintended file descriptors can lead to data corruption, privilege escalation, or denial of service.

  • fix: Internal API functions now use a leading underscore (_) to clearly distinguish them from public APIs.

  • new: Added a function for weakness visualization. Refer to the examples for usage details.

  • new: Added API documentation and examples for usage details.

Version 1.1:What’s New#

We’ve released a new version with several key improvements focused on making your security workflow smoother and providing more detailed security information.

  • Streamlined Scanning:

The separate directoryscan command has been removed. You can now use the versatile filescan command to scan both individual files and entire directories. This simplifies the command-line interface and makes the process more intuitive.

  • Enhanced Reporting:

We’ve made minor corrections to the documentation and static HTML reports to improve clarity. Additionally, warning messages are now more descriptive, helping you quickly understand potential issues.

  • Improved Vulnerability Data:

You’ll now get more detailed information about module vulnerabilities. The tool now includes CVSS scores, a standard metric for rating vulnerability severity, giving you a clearer picture of the risks.

  • Behind-the-Scenes Fixes:

We’ve made a more robust and reliable adjustment to how the tool retrieves file names. This ensures consistency and accuracy during scans. We’ve also added beta-level API functions, opening up new possibilities for integration.

Version 1.0#

This release represents a stabilisation of Python Code Audit! Main changes in relation to the pre-1.0 versions are:

  • More validations added: Python Code Audit now counts 70 security validations!

  • Documentation updates

  • Improved validation for builtins, like compile, exec, eval that can be obfuscated in code.

  • Various UI/UX updates. CLI text improved and HTML report text made consistent.

  • Added test to validate correct working for now and in the future. Also validated working with other SAST tools to make sure core functionality is rock solid or better! Spoiler Python Code Audit is better than most used OSS and commercial SAST tools available today!

Beta Versions (Before 1.0)#

All published beta version are stable and verified! During the public beta phase input of users and experts is retrieved. This resulted is mainly:

  • More validation

  • Better documentation and

  • UI/UX improvements to make sure Python Code Audit is dead simple to use for non-programmers to validate a Python package.