What's Changed

• chore: fixed some typos in comments by @jakob1379 in #1351
• Bump docker/login-action from 3.6.0 to 3.7.0 by @dependabot[bot] in #1353
• Bump docker/build-push-action from 6.18.0 to 6.19.2 by @dependabot[bot] in #1357
• Fix B613 crash when reading from stdin by @worksbyfriday in #1361
• Include filename in nosec 'no failed test' warning by @worksbyfriday in #1363
• Fix B615 false positive when revision is set via variable by @worksbyfriday in #1358
• Lower version guard in check_ast_node to Python 3.12 by @rcgray in #1355
• Fix B106 reporting wrong line number on multiline function calls by @worksbyfriday in #1360

New Contributors

• @jakob1379 made their first contribution in #1351
• @worksbyfriday made their first contribution in #1361
• @rcgray made their first contribution in #1355

Full Changelog: 1.9.3...1.9.4

What's Changed

• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #1334
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1335
• Fix B608 to detect VALUES( without space by @kfess in #1337
• Add check for hardcoded passwords in dicts. by @alanverresen in #1338
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1341
• Update tox tests for Python 3.10 by @willschlitzer in #1346
• Bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by @dependabot[bot] in #1347
• Limit B614 to torch.load deserializers by @dibussoc in #1348

New Contributors

• @kfess made their first contribution in #1337
• @alanverresen made their first contribution in #1338
• @willschlitzer made their first contribution in #1346
• @dibussoc made their first contribution in #1348

Full Changelog: 1.9.2...1.9.3

What's Changed

• Argparse Python 3.14 enhancements by @ericwb in #1331
• Check whether Constant value is str by @ericwb in #1333

Full Changelog: 1.9.1...1.9.2

What's Changed

• More Python version related fixes by @ericwb in #1327

Full Changelog: 1.9.0...1.9.1

What's Changed

• Add instructions for Maintainers to create/publish a release by @ericwb in #1275
• Bump sigstore/cosign-installer from 3.9.1 to 3.9.2 by @dependabot[bot] in #1289
• Bump docker/login-action from 3.4.0 to 3.5.0 by @dependabot[bot] in #1290
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1291
• Bump actions/checkout from 4 to 5 by @dependabot[bot] in #1292
• Replace deprecated datetime.datetime.utcnow() by @purplezimmermann in #1295
• Bump actions/setup-python from 5 to 6 by @dependabot[bot] in #1296
• Bump sigstore/cosign-installer from 3.9.2 to 3.10.0 by @dependabot[bot] in #1298
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1303
• Fix typos by @Shortfinga in #1305
• Bump docker/login-action from 3.5.0 to 3.6.0 by @dependabot[bot] in #1306
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1315
• Bump sigstore/cosign-installer from 3.10.0 to 4.0.0 by @dependabot[bot] in #1317
• Support of Python 3.14 by @ericwb in #1323
• Drop support of end-of-life Python 3.9 by @ericwb in #1325
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1324

New Contributors

• @purplezimmermann made their first contribution in #1295
• @Shortfinga made their first contribution in #1305

Full Changelog: 1.8.6...1.9.0

What's Changed

• Bump sigstore/cosign-installer from 3.8.2 to 3.9.0 by @dependabot in #1279
• Bump docker/setup-buildx-action from 3.10.0 to 3.11.1 by @dependabot in #1278
• added hint to FreeBSD package in doc/source/integrations.rst by @daniel-mohr in #1282
• Bump sigstore/cosign-installer from 3.9.0 to 3.9.1 by @dependabot in #1284
• Huggingface revision pinning by @lukehinds in #1281

New Contributors

• @daniel-mohr made their first contribution in #1282

Full Changelog: 1.8.5...1.8.6

What's Changed

• Fix the rendering of the CI/CD doc by @ericwb in #1274
• Fix for publish to PyPI failure by @ericwb in #1273

Full Changelog: 1.8.4...1.8.5

What's Changed

• Add more random functions to B311 check by @aripollak in #1235
• Metadata: rename classifier to classifiers by @ericwb in #1237
• Bump sigstore/cosign-installer from 3.8.0 to 3.8.1 by @dependabot in #1239
• Bump docker/build-push-action from 6.13.0 to 6.14.0 by @dependabot in #1238
• Bump docker/build-push-action from 6.14.0 to 6.15.0 by @dependabot in #1240
• Bump docker/setup-buildx-action from 3.9.0 to 3.10.0 by @dependabot in #1241
• Bump docker/login-action from 3.3.0 to 3.4.0 by @dependabot in #1245
• Bump bandit version in bug template by @ericwb in #1247
• Fix traceback from trojansource plugin by @ericwb in #1248
• Ensure the man page is built by @ericwb in #1257
• Update documentation to cover --severity-level and --confidence-level by @bmos in #1254
• Use license property in lieu of classifier by @ericwb in #1259
• Fix up some of the warnings when building docs by @ericwb in #1258
• Add a doc describing various integrations by @ericwb in #1253
• Use ubuntu latest for readthedocs build by @ericwb in #1260
• Bump docker/build-push-action from 6.15.0 to 6.16.0 by @dependabot in #1261
• Bump sigstore/cosign-installer from 3.8.1 to 3.8.2 by @dependabot in #1262
• Remove etc from list of temp paths by @ericwb in #1263
• Bump docker/build-push-action from 6.16.0 to 6.17.0 by @dependabot in #1265
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1266
• Bump docker/build-push-action from 6.17.0 to 6.18.0 by @dependabot in #1268
• add github-actions documentation by @Killpit in #1172

New Contributors

• @aripollak made their first contribution in #1235
• @bmos made their first contribution in #1254
• @Killpit made their first contribution in #1172

Full Changelog: 1.8.3...1.8.4

What's Changed

• Bump docker/build-push-action from 6.10.0 to 6.11.0 by @dependabot in #1220
• Bump docker/build-push-action from 6.11.0 to 6.12.0 by @dependabot in #1221
• Bump docker/build-push-action from 6.12.0 to 6.13.0 by @dependabot in #1222
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1229
• Update bug template to include latest released versions by @ericwb in #1218
• Add markupsafe.Markup XSS plugin by @Daverball in #1225
• Warn not error on an nonexistant test given by @ericwb in #1230
• Bump sigstore/cosign-installer from 3.7.0 to 3.8.0 by @dependabot in #1233
• Bump docker/setup-buildx-action from 3.8.0 to 3.9.0 by @dependabot in #1234
• B107: Skip None values in hardcoded password detection by @lukehinds in #1232
• Pytorch fix by @lukehinds in #1231

New Contributors

• @Daverball made their first contribution in #1225

Full Changelog: 1.8.2...1.8.3

What's Changed

• Revert "Start testing with 3.14 alphas" by @ericwb in #1217

Full Changelog: 1.8.1...1.8.2