diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
new file mode 100644
index 0000000..c255378
--- /dev/null
+++ b/.github/copilot-instructions.md
@@ -0,0 +1,49 @@
+---
+# Codacy Rules
+Configuration for AI behavior when interacting with Codacy's MCP Server
+
+## After ANY successful `edit_file` or `reapply` operation
+- YOU MUST IMMEDIATELY run the `codacy_cli_analyze` tool from Codacy's MCP Server for each file that was edited, with:
+ - `rootPath`: set to the workspace path
+ - `file`: set to the path of the edited file
+ - `tool`: leave empty or unset
+- If any issues are found in the new edits, propose and apply fixes for them.
+- > NOTE: Failure to follow this rule is considered a critical error.
+
+## CRITICAL: Dependencies and Security Checks
+- IMMEDIATELY after ANY of these actions:
+ - Running npm/yarn/pnpm install
+ - Adding dependencies to package.json
+ - Adding requirements to requirements.txt
+ - Adding dependencies to pom.xml
+ - Adding dependencies to build.gradle
+ - Any other package manager operations
+- You MUST run the `codacy_cli_analyze` tool with:
+ - `rootPath`: set to the workspace path
+ - `tool`: set to "trivy"
+ - `file`: leave empty or unset
+- If any vulnerabilities are found because of the newly added packages:
+ - Stop all other operations
+ - Propose and apply fixes for the security issues
+ - Only continue with the original task after security issues are resolved
+- EXAMPLE:
+ - After: npm install react-markdown
+ - Do: Run codacy_cli_analyze with trivy
+ - Before: Continuing with any other tasks
+
+## General
+- Repeat the relevant steps for each modified file.
+- "Propose fixes" means to both suggest and, if possible, automatically apply the fixes.
+- You MUST NOT wait for the user to ask for analysis or remind you to run the tool.
+- Do not run `codacy_cli_analyze` looking for changes in duplicated code or code complexity metrics.
+- Do not run `codacy_cli_analyze` looking for changes in code coverage.
+- Do not try to manually install Codacy CLI using either brew, npm, npx, or any other package manager.
+- If the Codacy CLI is not installed, just run the `codacy_cli_analyze` tool from Codacy's MCP Server.
+- When calling `codacy_cli_analyze`, only send provider, organization and repository if the project is a git repository.
+
+## Whenever a call to a Codacy tool that uses `repository` or `organization` as a parameter returns a 404 error
+- Offer to run the `codacy_setup_repository` tool to add the repository to Codacy
+- If the user accepts, run the `codacy_setup_repository` tool
+- Do not ever try to run the `codacy_setup_repository` tool on your own
+- After setup, immediately retry the action that failed (only retry once)
+---
\ No newline at end of file
diff --git a/doc-generator/src/main/scala/docs/transformers/BlacklistDocTransformer.scala b/doc-generator/src/main/scala/docs/transformers/BlacklistDocTransformer.scala
index 439e6f2..c752ac9 100644
--- a/doc-generator/src/main/scala/docs/transformers/BlacklistDocTransformer.scala
+++ b/doc-generator/src/main/scala/docs/transformers/BlacklistDocTransformer.scala
@@ -70,6 +70,7 @@ object BlacklistDocTransformer extends IPatternDocTransformer {
Level.Warn,
Pattern.Category.Security,
SecuritySubcategories.get(patternIdCapitalized),
+ Some(Pattern.ScanType.SAST),
Set.empty,
Set.empty,
enabled = DefaultPatterns.list.contains(patternIdCapitalized.value)
diff --git a/doc-generator/src/main/scala/docs/transformers/PluginsDocGenerator.scala b/doc-generator/src/main/scala/docs/transformers/PluginsDocGenerator.scala
index c780f86..45a05c7 100644
--- a/doc-generator/src/main/scala/docs/transformers/PluginsDocGenerator.scala
+++ b/doc-generator/src/main/scala/docs/transformers/PluginsDocGenerator.scala
@@ -4,7 +4,7 @@ import docs.transformers.utils.HtmlLoader
import scala.xml._
import better.files._
-import com.codacy.plugins.api.results.Pattern.Category
+import com.codacy.plugins.api.results.Pattern.{Category, Scantype}
import com.codacy.plugins.api.results.Result.Level
import com.codacy.plugins.api.results.Pattern
import docs.{DefaultPatterns, SecuritySubcategories}
@@ -52,7 +52,7 @@ object PluginsDocTransformer extends IPatternDocTransformer {
divs <- htmlPluginsDocs
if (divs \@ "id").startsWith(patternId.value.toLowerCase())
divsChildren <- divs.child.filter { node =>
- val l = node.labels
+ val l = node.label
l == "h1" || l == "h2" || l == "p"
}
} yield divsChildren
@@ -80,6 +80,8 @@ object PluginsDocTransformer extends IPatternDocTransformer {
severity,
Category.Security,
SecuritySubcategories.get(patternIdCapitalized),
+ Some(ScanType.SAST),
+ Set.empty,
Set.empty,
enabled = DefaultPatterns.list.contains(patternIdCapitalized.value)
)
diff --git a/docs/description/B613.md b/docs/description/B613.md
new file mode 100644
index 0000000..1fdd279
--- /dev/null
+++ b/docs/description/B613.md
@@ -0,0 +1,162 @@
+Bandit
+
+- Getting
+ Started
+- Configuration
+- Integrations
+- Test
+ Plugins
+ - Writing Tests
+ - Config Generation
+ - Example Test Plugin
+ - Plugin ID Groupings
+ - Complete Test Plugin Listing
+ - B101: assert_used
+ - B102: exec_used
+ - B103: set_bad_file_permissions
+ - B104:
+ hardcoded_bind_all_interfaces
+ - B105: hardcoded_password_string
+ - B106:
+ hardcoded_password_funcarg
+ - B107:
+ hardcoded_password_default
+ - B108: hardcoded_tmp_directory
+ - B109:
+ password_config_option_not_marked_secret
+ - B110: try_except_pass
+ - B111:
+ execute_with_run_as_root_equals_true
+ - B112: try_except_continue
+ - B113: request_without_timeout
+ - B201: flask_debug_true
+ - B202: tarfile_unsafe_members
+ - B324: hashlib
+ - B501:
+ request_with_no_cert_validation
+ - B502: ssl_with_bad_version
+ - B503: ssl_with_bad_defaults
+ - B504: ssl_with_no_version
+ - B505: weak_cryptographic_key
+ - B506: yaml_load
+ - B507:
+ ssh_no_host_key_verification
+ - B508: snmp_insecure_version
+ - B509: snmp_weak_cryptography
+ - B601: paramiko_calls
+ - B602:
+ subprocess_popen_with_shell_equals_true
+ - B603:
+ subprocess_without_shell_equals_true
+ - B604:
+ any_other_function_with_shell_equals_true
+ - B605:
+ start_process_with_a_shell
+ - B606:
+ start_process_with_no_shell
+ - B607:
+ start_process_with_partial_path
+ - B608: hardcoded_sql_expressions
+ - B609:
+ linux_commands_wildcard_injection
+ - B610: django_extra_used
+ - B611: django_rawsql_used
+ - B612:
+ logging_config_insecure_listen
+ - B613:
+ trojansource
+ - B614: pytorch_load
+ - B615:
+ huggingface_unsafe_download
+ - B701: jinja2_autoescape_false
+ - B702: use_of_mako_templates
+ - B703: django_mark_safe
+ - B704: markupsafe_markup_xss
+- Blacklist Plugins
+- Report Formatters
+- Continuous Integration and Deployment (CI/CD)
+- Frequently
+ Asked Questions
+
+Bandit
+
+-
+- Test Plugins
+- B613: trojansource
+- View page source
+
+------------------------------------------------------------------------
+
+# B613: trojansource
+
+Previous
+Next
+
+------------------------------------------------------------------------
+
+© Copyright 2025, Bandit Developers.
+
+Built with Sphinx
+using a theme provided by
+Read the Docs.
diff --git a/docs/description/B614.md b/docs/description/B614.md
new file mode 100644
index 0000000..3538e5a
--- /dev/null
+++ b/docs/description/B614.md
@@ -0,0 +1,162 @@
+Bandit
+
+- Getting
+ Started
+- Configuration
+- Integrations
+- Test
+ Plugins
+ - Writing Tests
+ - Config Generation
+ - Example Test Plugin
+ - Plugin ID Groupings
+ - Complete Test Plugin Listing
+ - B101: assert_used
+ - B102: exec_used
+ - B103: set_bad_file_permissions
+ - B104:
+ hardcoded_bind_all_interfaces
+ - B105: hardcoded_password_string
+ - B106:
+ hardcoded_password_funcarg
+ - B107:
+ hardcoded_password_default
+ - B108: hardcoded_tmp_directory
+ - B109:
+ password_config_option_not_marked_secret
+ - B110: try_except_pass
+ - B111:
+ execute_with_run_as_root_equals_true
+ - B112: try_except_continue
+ - B113: request_without_timeout
+ - B201: flask_debug_true
+ - B202: tarfile_unsafe_members
+ - B324: hashlib
+ - B501:
+ request_with_no_cert_validation
+ - B502: ssl_with_bad_version
+ - B503: ssl_with_bad_defaults
+ - B504: ssl_with_no_version
+ - B505: weak_cryptographic_key
+ - B506: yaml_load
+ - B507:
+ ssh_no_host_key_verification
+ - B508: snmp_insecure_version
+ - B509: snmp_weak_cryptography
+ - B601: paramiko_calls
+ - B602:
+ subprocess_popen_with_shell_equals_true
+ - B603:
+ subprocess_without_shell_equals_true
+ - B604:
+ any_other_function_with_shell_equals_true
+ - B605:
+ start_process_with_a_shell
+ - B606:
+ start_process_with_no_shell
+ - B607:
+ start_process_with_partial_path
+ - B608: hardcoded_sql_expressions
+ - B609:
+ linux_commands_wildcard_injection
+ - B610: django_extra_used
+ - B611: django_rawsql_used
+ - B612:
+ logging_config_insecure_listen
+ - B613: trojansource
+ - B614:
+ pytorch_load
+ - B615:
+ huggingface_unsafe_download
+ - B701: jinja2_autoescape_false
+ - B702: use_of_mako_templates
+ - B703: django_mark_safe
+ - B704: markupsafe_markup_xss
+- Blacklist Plugins
+- Report Formatters
+- Continuous Integration and Deployment (CI/CD)
+- Frequently
+ Asked Questions
+
+Bandit
+
+-
+- Test Plugins
+- B614: pytorch_load
+- View page source
+
+------------------------------------------------------------------------
+
+# B614: pytorch_load
+
+Previous
+Next
+
+------------------------------------------------------------------------
+
+© Copyright 2025, Bandit Developers.
+
+Built with Sphinx
+using a theme provided by
+Read the Docs.
diff --git a/docs/description/B615.md b/docs/description/B615.md
new file mode 100644
index 0000000..e905ea0
--- /dev/null
+++ b/docs/description/B615.md
@@ -0,0 +1,161 @@
+Bandit
+
+- Getting
+ Started
+- Configuration
+- Integrations
+- Test
+ Plugins
+ - Writing Tests
+ - Config Generation
+ - Example Test Plugin
+ - Plugin ID Groupings
+ - Complete Test Plugin Listing
+ - B101: assert_used
+ - B102: exec_used
+ - B103: set_bad_file_permissions
+ - B104:
+ hardcoded_bind_all_interfaces
+ - B105: hardcoded_password_string
+ - B106:
+ hardcoded_password_funcarg
+ - B107:
+ hardcoded_password_default
+ - B108: hardcoded_tmp_directory
+ - B109:
+ password_config_option_not_marked_secret
+ - B110: try_except_pass
+ - B111:
+ execute_with_run_as_root_equals_true
+ - B112: try_except_continue
+ - B113: request_without_timeout
+ - B201: flask_debug_true
+ - B202: tarfile_unsafe_members
+ - B324: hashlib
+ - B501:
+ request_with_no_cert_validation
+ - B502: ssl_with_bad_version
+ - B503: ssl_with_bad_defaults
+ - B504: ssl_with_no_version
+ - B505: weak_cryptographic_key
+ - B506: yaml_load
+ - B507:
+ ssh_no_host_key_verification
+ - B508: snmp_insecure_version
+ - B509: snmp_weak_cryptography
+ - B601: paramiko_calls
+ - B602:
+ subprocess_popen_with_shell_equals_true
+ - B603:
+ subprocess_without_shell_equals_true
+ - B604:
+ any_other_function_with_shell_equals_true
+ - B605:
+ start_process_with_a_shell
+ - B606:
+ start_process_with_no_shell
+ - B607:
+ start_process_with_partial_path
+ - B608: hardcoded_sql_expressions
+ - B609:
+ linux_commands_wildcard_injection
+ - B610: django_extra_used
+ - B611: django_rawsql_used
+ - B612:
+ logging_config_insecure_listen
+ - B613: trojansource
+ - B614: pytorch_load
+ - B615:
+ huggingface_unsafe_download
+ - B701: jinja2_autoescape_false
+ - B702: use_of_mako_templates
+ - B703: django_mark_safe
+ - B704: markupsafe_markup_xss
+- Blacklist Plugins
+- Report Formatters
+- Continuous Integration and Deployment (CI/CD)
+- Frequently
+ Asked Questions
+
+Bandit
+
+-
+- Test Plugins
+- B615: huggingface_unsafe_download
+- View page source
+
+------------------------------------------------------------------------
+
+# B615: huggingface_unsafe_download
+
+Previous
+Next
+
+------------------------------------------------------------------------
+
+© Copyright 2025, Bandit Developers.
+
+Built with Sphinx
+using a theme provided by
+Read the Docs.
diff --git a/docs/description/B704.md b/docs/description/B704.md
new file mode 100644
index 0000000..f024bf6
--- /dev/null
+++ b/docs/description/B704.md
@@ -0,0 +1,161 @@
+Bandit
+
+- Getting
+ Started
+- Configuration
+- Integrations
+- Test
+ Plugins
+ - Writing Tests
+ - Config Generation
+ - Example Test Plugin
+ - Plugin ID Groupings
+ - Complete Test Plugin Listing
+ - B101: assert_used
+ - B102: exec_used
+ - B103: set_bad_file_permissions
+ - B104:
+ hardcoded_bind_all_interfaces
+ - B105: hardcoded_password_string
+ - B106:
+ hardcoded_password_funcarg
+ - B107:
+ hardcoded_password_default
+ - B108: hardcoded_tmp_directory
+ - B109:
+ password_config_option_not_marked_secret
+ - B110: try_except_pass
+ - B111:
+ execute_with_run_as_root_equals_true
+ - B112: try_except_continue
+ - B113: request_without_timeout
+ - B201: flask_debug_true
+ - B202: tarfile_unsafe_members
+ - B324: hashlib
+ - B501:
+ request_with_no_cert_validation
+ - B502: ssl_with_bad_version
+ - B503: ssl_with_bad_defaults
+ - B504: ssl_with_no_version
+ - B505: weak_cryptographic_key
+ - B506: yaml_load
+ - B507:
+ ssh_no_host_key_verification
+ - B508: snmp_insecure_version
+ - B509: snmp_weak_cryptography
+ - B601: paramiko_calls
+ - B602:
+ subprocess_popen_with_shell_equals_true
+ - B603:
+ subprocess_without_shell_equals_true
+ - B604:
+ any_other_function_with_shell_equals_true
+ - B605:
+ start_process_with_a_shell
+ - B606:
+ start_process_with_no_shell
+ - B607:
+ start_process_with_partial_path
+ - B608: hardcoded_sql_expressions
+ - B609:
+ linux_commands_wildcard_injection
+ - B610: django_extra_used
+ - B611: django_rawsql_used
+ - B612:
+ logging_config_insecure_listen
+ - B613: trojansource
+ - B614: pytorch_load
+ - B615:
+ huggingface_unsafe_download
+ - B701: jinja2_autoescape_false
+ - B702: use_of_mako_templates
+ - B703: django_mark_safe
+ - B704:
+ markupsafe_markup_xss
+- Blacklist Plugins
+- Report Formatters
+- Continuous Integration and Deployment (CI/CD)
+- Frequently
+ Asked Questions
+
+Bandit
+
+-
+- Test Plugins
+- B704: markupsafe_markup_xss
+- View page source
+
+------------------------------------------------------------------------
+
+# B704: markupsafe_markup_xss
+
+Previous
+Next
+
+------------------------------------------------------------------------
+
+© Copyright 2025, Bandit Developers.
+
+Built with Sphinx
+using a theme provided by
+Read the Docs.
diff --git a/requirements.txt b/requirements.txt
index 7e4787d..b055de0 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1 +1 @@
-bandit==1.8.3
+bandit==1.8.6