[Triage] Declared floor bandit[toml]>=1.7.0 predates the toml extra that the pinned '-c pyproject.toml' invocation relies on (CR-A16-117)

Needs triage. Reviewers disagreed on this finding, so it is not counted in the backlog. Decide whether it is a real defect: if yes, set severity and wave; if not, close it with the reason.

CR-A16-117 — Declared floor bandit[toml]>=1.7.0 predates the toml extra that the pinned '-c pyproject.toml' invocation relies on

severity Info · confidence disputed · single reviewer · not reproduced (code trace)

What happens. pyproject.toml:224/234 and ci.yml:519 declare bandit[toml]>=1.7.0,<2.0.0, and CI/nightly run 'bandit -c pyproject.toml -r forgelm/'. PyPI metadata for bandit 1.7.0 and 1.7.1 lists no 'toml' extra or tomli requirement. The extra first appears in the 1.7.4 metadata. 1.7.2 and 1.7.3 were not checked. The resolver always picks the newest 1.x (1.9.4 is current), so the floor is never exercised in CI. A constrained or lockfile install at the floor would not honour [tool.bandit] exclude_dirs.

Failure scenario. An operator pins bandit to the floor (for example under a corporate constraints file). The scan silently ignores or mis-parses the project config, and the severity gate runs over a different scope than documented.

Where.

Evidence.

PyPI JSON for bandit 1.7.0 and 1.7.1: no toml requires_dist. 1.7.4: "toml ; extra == 'toml'". 1.7.5 onward: "tomli>=1.1.0; python_version < '3.11' and extra == 'toml'".

Recommended fix. Raise the floor to the first release that actually reads pyproject.toml (>=1.7.4, to be confirmed). Or add a test that bandit's version is >= that floor.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}

The metadata point holds. bandit 1.7.0 to 1.7.2 publish no toml extra (PyPI: it first appears in 1.7.3, not 1.7.4), and the floor is never exercised because CI and the nightly resolve the latest 1.x (1.9.4 today).

The failure mode is milder than described: a bandit that rejects -c pyproject.toml exits before writing a report, and tools/check_bandit.py exits 1 on a missing report, so the gate fails loudly instead of scanning a different scope.

We will still make the declaration true. Proposed floor: 1.8.0, the first release that lists Python 3.13, which the CI matrix covers. It appears in pyproject.toml (twice), ci.yml:549 and the supply-chain reference (English and Turkish) — five one-line edits.

Triage result: dependencies, area: packaging-ci, severity: info, wave: 4.

Triage round 1, checked against development on 2026-10-20.

Where to start

Thanks for taking a look. Claim it by starting a comment with /assign so nobody duplicates the work.

The floor is already decided in the triage note above: 1.8.0. Change >=1.7.0 to >=1.8.0 and keep <2.0.0 in these five places. The line numbers are those on development; the ci.yml one has moved from 549 to 559.

pyproject.toml, line 236 (dev extra) and line 246 (security extra)
.github/workflows/ci.yml, line 559 (python -m pip install 'bandit[toml]>=...')
docs/reference/supply_chain_security.md, line 216
docs/reference/supply_chain_security-tr.md, line 220

Both documentation lines sit inside a fenced TOML block that is identical in English and Turkish. No Turkish prose changes, but the two files must change together. You may also update the two copies in docs/design/iso27001_soc2_alignment.md (lines 476 and 492), so that a search for the old floor comes back empty.

tests/test_packaging.py::test_bandit_pin_matches_the_dev_and_security_extras already fails if [dev], [security] and ci.yml disagree, so run it after editing. It does not check the floor value, so add one test next to it in the same module. For each of the dev and security extras, assert that the >= bound of the bandit requirement is at least Version("1.8.0"). Requirement, canonicalize_name and Version are already imported there, and _load_optional_dependencies() returns the extras.

pytest tests/test_packaging.py --no-cov -k bandit
python3 tools/check_bilingual_parity.py --strict
python3 tools/check_bilingual_code_blocks.py --strict
python3 tools/check_ci_failure_masking.py --strict

No GPU, network access or model download is needed. Add a ### Changed entry under ## [Unreleased] in CHANGELOG.md; users install this extra with pip install forgelm[security].

Open the PR against development with Fixes #828 (finding CR-A16-117).

Navigation Menu

Repository navigation

[Triage] Declared floor bandit[toml]>=1.7.0 predates the toml extra that the pinned '-c pyproject.toml' invocation relies on (CR-A16-117) #828

CR-A16-117 — Declared floor bandit[toml]>=1.7.0 predates the toml extra that the pinned '-c pyproject.toml' invocation relies on

Where to start

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Triage] Declared floor bandit[toml]>=1.7.0 predates the toml extra that the pinned '-c pyproject.toml' invocation relies on (CR-A16-117) #828

Description

CR-A16-117 — Declared floor bandit[toml]>=1.7.0 predates the toml extra that the pinned '-c pyproject.toml' invocation relies on

Activity

cemililik commented on Oct 20, 2026

cemililik commented on Oct 22, 2026

Where to start

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions