chore: bump python version

Author: lhoupert

pyproject.toml

@@ -7,7 +7,7 @@ name = "python-security-auditing"
 version = "0.1.0"
 description = "Reusable GitHub Action for Python security auditing with bandit and pip-audit"
 license = { text = "MIT" }
-requires-python = ">=3.11"
+requires-python = ">=3.13"
 dependencies = [
     "pydantic-settings>=2.0",
     "bandit>=1.8",
@@ -33,7 +33,7 @@ line-length = 100
 select = ["E", "F", "I", "UP"]
 
 [tool.mypy]
-python_version = "3.11"
+python_version = "3.13"
 strict = true
 
 [tool.pytest.ini_options]

src/python_security_auditing/report.py

@@ -49,10 +49,7 @@ def _bandit_section(report: dict[str, Any], settings: Settings) -> str:
         lines.append("✅ No issues found.\n")
         return "\n".join(lines)
 
-    lines.append(
-        "| Severity | Confidence | File | Line | Issue |\n"
-        "|---|---|---|---|---|\n"
-    )
+    lines.append("| Severity | Confidence | File | Line | Issue |\n" "|---|---|---|---|---|\n")
     for r in results:
         sev = r.get("issue_severity", "")
         conf = r.get("issue_confidence", "")
@@ -82,8 +79,7 @@ def _pip_audit_section(report: list[dict[str, Any]], settings: Settings) -> str:
         return "\n".join(lines)
 
     lines.append(
-        "| Package | Version | ID | Fix Versions | Description |\n"
-        "|---|---|---|---|---|\n"
+        "| Package | Version | ID | Fix Versions | Description |\n" "|---|---|---|---|---|\n"
     )
     for pkg in vulnerable:
         name = pkg.get("name", "")
@@ -95,12 +91,7 @@ def _pip_audit_section(report: list[dict[str, Any]], settings: Settings) -> str:
             lines.append(f"| {name} | {version} | {vid} | {fix_versions} | {desc} |")
 
     total_vulns = sum(len(pkg.get("vulns", [])) for pkg in vulnerable)
-    fixable = sum(
-        1
-        for pkg in vulnerable
-        for v in pkg.get("vulns", [])
-        if v.get("fix_versions")
-    )
+    fixable = sum(1 for pkg in vulnerable for v in pkg.get("vulns", []) if v.get("fix_versions"))
     lines.append(
         f"\n_{total_vulns} vulnerability/vulnerabilities found "
         f"({fixable} fixable) across {len(vulnerable)} package(s)._\n"

tests/test_report.py

@@ -6,7 +6,6 @@
 from pathlib import Path
 
 import pytest
-
 from python_security_auditing.report import build_markdown, check_thresholds, write_step_summary
 from python_security_auditing.settings import Settings
 
@@ -57,7 +56,9 @@ def test_bandit_high_blocks(bandit_issues: dict, pip_clean: list) -> None:  # ty
     assert check_thresholds(bandit_issues, pip_clean, s) is True
 
 
-def test_bandit_medium_does_not_block_at_high_threshold(bandit_issues: dict, pip_clean: list) -> None:  # type: ignore[type-arg]
+def test_bandit_medium_does_not_block_at_high_threshold(
+    bandit_issues: dict, pip_clean: list
+) -> None:  # type: ignore[type-arg]
     """bandit_issues has HIGH and MEDIUM; only HIGH should block when threshold=HIGH."""
     s = Settings()
     # Remove HIGH results so only MEDIUM remain
@@ -68,7 +69,9 @@ def test_bandit_medium_does_not_block_at_high_threshold(bandit_issues: dict, pip
     assert check_thresholds(medium_only, pip_clean, s) is False
 
 
-def test_bandit_medium_blocks_at_medium_threshold(bandit_issues: dict, pip_clean: list, monkeypatch: pytest.MonkeyPatch) -> None:  # type: ignore[type-arg]
+def test_bandit_medium_blocks_at_medium_threshold(
+    bandit_issues: dict, pip_clean: list, monkeypatch: pytest.MonkeyPatch
+) -> None:  # type: ignore[type-arg]
     monkeypatch.setenv("BANDIT_SEVERITY_THRESHOLD", "MEDIUM")
     s = Settings()
     medium_only = {
@@ -88,19 +91,25 @@ def test_pip_unfixable_does_not_block_on_fixable(bandit_clean: dict, pip_unfixab
     assert check_thresholds(bandit_clean, pip_unfixable, s) is False
 
 
-def test_pip_unfixable_blocks_on_all(bandit_clean: dict, pip_unfixable: list, monkeypatch: pytest.MonkeyPatch) -> None:  # type: ignore[type-arg]
+def test_pip_unfixable_blocks_on_all(
+    bandit_clean: dict, pip_unfixable: list, monkeypatch: pytest.MonkeyPatch
+) -> None:  # type: ignore[type-arg]
     monkeypatch.setenv("PIP_AUDIT_BLOCK_ON", "all")
     s = Settings()
     assert check_thresholds(bandit_clean, pip_unfixable, s) is True
 
 
-def test_pip_fixable_does_not_block_on_none(bandit_clean: dict, pip_fixable: list, monkeypatch: pytest.MonkeyPatch) -> None:  # type: ignore[type-arg]
+def test_pip_fixable_does_not_block_on_none(
+    bandit_clean: dict, pip_fixable: list, monkeypatch: pytest.MonkeyPatch
+) -> None:  # type: ignore[type-arg]
     monkeypatch.setenv("PIP_AUDIT_BLOCK_ON", "none")
     s = Settings()
     assert check_thresholds(bandit_clean, pip_fixable, s) is False
 
 
-def test_bandit_only_tool_skips_pip(bandit_issues: dict, pip_fixable: list, monkeypatch: pytest.MonkeyPatch) -> None:  # type: ignore[type-arg]
+def test_bandit_only_tool_skips_pip(
+    bandit_issues: dict, pip_fixable: list, monkeypatch: pytest.MonkeyPatch
+) -> None:  # type: ignore[type-arg]
     monkeypatch.setenv("TOOLS", "bandit")
     s = Settings()
     # pip-audit not in enabled tools, so fixable vulns should not block
@@ -109,15 +118,19 @@ def test_bandit_only_tool_skips_pip(bandit_issues: dict, pip_fixable: list, monk
     assert result is True
 
 
-def test_pip_only_tool_skips_bandit(bandit_issues: dict, pip_fixable: list, monkeypatch: pytest.MonkeyPatch) -> None:  # type: ignore[type-arg]
+def test_pip_only_tool_skips_bandit(
+    bandit_issues: dict, pip_fixable: list, monkeypatch: pytest.MonkeyPatch
+) -> None:  # type: ignore[type-arg]
     monkeypatch.setenv("TOOLS", "pip-audit")
     s = Settings()
     # bandit not in enabled tools, bandit HIGH issues should not block
     result = check_thresholds(bandit_issues, pip_fixable, s)
     assert result is True  # pip-audit fixable issues do block
 
 
-def test_pip_only_no_bandit_blocking(bandit_issues: dict, pip_clean: list, monkeypatch: pytest.MonkeyPatch) -> None:  # type: ignore[type-arg]
+def test_pip_only_no_bandit_blocking(
+    bandit_issues: dict, pip_clean: list, monkeypatch: pytest.MonkeyPatch
+) -> None:  # type: ignore[type-arg]
     monkeypatch.setenv("TOOLS", "pip-audit")
     s = Settings()
     assert check_thresholds(bandit_issues, pip_clean, s) is False
@@ -162,7 +175,9 @@ def test_markdown_pip_table(bandit_clean: dict, pip_fixable: list) -> None:  # t
     assert "GHSA-j8r2-6x86-q33q" in md
 
 
-def test_markdown_run_url(bandit_clean: dict, pip_clean: list, monkeypatch: pytest.MonkeyPatch) -> None:  # type: ignore[type-arg]
+def test_markdown_run_url(
+    bandit_clean: dict, pip_clean: list, monkeypatch: pytest.MonkeyPatch
+) -> None:  # type: ignore[type-arg]
     monkeypatch.setenv("GITHUB_REPOSITORY", "org/repo")
     monkeypatch.setenv("GITHUB_RUN_ID", "999")
     s = Settings()

tests/test_runners.py

@@ -7,7 +7,6 @@
 from unittest.mock import MagicMock, patch
 
 import pytest
-
 from python_security_auditing.runners import generate_requirements, run_bandit, run_pip_audit
 from python_security_auditing.settings import Settings
 
@@ -103,7 +102,9 @@ def test_run_bandit_parses_json(tmp_path: Path, monkeypatch: pytest.MonkeyPatch)
     assert report["results"][0]["issue_severity"] == "HIGH"
 
 
-def test_run_bandit_returns_empty_on_missing_file(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_run_bandit_returns_empty_on_missing_file(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
     monkeypatch.chdir(tmp_path)
 
     with patch("python_security_auditing.runners.subprocess.run") as mock_run:
@@ -146,7 +147,9 @@ def test_run_pip_audit_parses_json(tmp_path: Path, monkeypatch: pytest.MonkeyPat
     assert (tmp_path / "pip-audit-report.json").exists()
 
 
-def test_run_pip_audit_returns_empty_on_no_output(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_run_pip_audit_returns_empty_on_no_output(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
     monkeypatch.chdir(tmp_path)
 
     with patch("python_security_auditing.runners.subprocess.run") as mock_run:
@@ -156,7 +159,9 @@ def test_run_pip_audit_returns_empty_on_no_output(tmp_path: Path, monkeypatch: p
     assert report == []
 
 
-def test_run_pip_audit_uses_requirements_path(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_run_pip_audit_uses_requirements_path(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
     monkeypatch.chdir(tmp_path)
     req_path = tmp_path / "custom-reqs.txt"
 

tests/test_settings.py

@@ -1,7 +1,6 @@
 """Tests for settings.py — env var parsing and computed properties."""
 
 import pytest
-
 from python_security_auditing.settings import Settings