[SizzleUnrlsd]

Release 0.9.0 adds one change, following #145.

• Advisory entry points name the arguments the attacker must control (Advisories: an entry point names the argument the attacker must control #145). An entry point may list attacker_arguments: by keyword, by position, or as a variadic parameter from its position on. A call is then exploitable only when attacker input reaches one of those arguments. Attacker input in another argument leaves it reachable, e.g. send_from_directory(..., download_name=data), or a request body when the vulnerability needs the URL. Arguments unpacked with * or ** still count. An entry point that names no argument keeps the 0.8.0 behaviour.

Existing advisory files load unchanged. The cache format does not change: an advisory that gains attacker_arguments changes the configuration key through repr(advisories).

The curated data needs this release: sqlparse, the Werkzeug safe_join advisories and requests (CoreTrace-Entreprise/coretrace-python-analyzer-plugins#2) wait for it, and so does the retargeting of the shipped CVE-2024-49766.

Changes in this PR

• Version: bumped in pyproject.toml, coretrace_python.__version__, the release test and the report example of the usage guide.
• CHANGELOG.md: the Unreleased section is dated as 0.9.0. No entry changed.
• Labels: this repository had no chore label, so it was created for release and maintenance PRs.

Verification

• pytest: 1101 passed, 2 skipped.
• pytest -m regression under Python 3.12: 19 passed.
• ruff check on the tracked files, and mypy: clean.

Tag v0.9.0 after merge to publish.