Skip to content

v0.5.0 - #175

Merged
nyudenkov merged 5 commits into
mainfrom
dev
Aug 20, 2026
Merged

v0.5.0#175
nyudenkov merged 5 commits into
mainfrom
dev

Conversation

@nyudenkov

Copy link
Copy Markdown
Owner

No description provided.

Extends existing config tables.

- [ignore].packages suppresses a package across all versions (PEP 503
  matched); suppressed findings stay in the report but are excluded from
  the fail_on exit condition
- [groups.<name>].fail_on sets a per-group severity threshold; a
  finding's effective threshold is the minimum across reaching contexts.
  Main-reachable packages floor at the global fail_on; group-only
  packages may loosen below it
- attribution (graph.rs: group-reachable closures + main-reachable
  closure) runs only when [groups.*] is configured, and only for
  uv.lock/poetry.lock/pylock.toml — no policy means no extra parsing
- sources.fail_on_partial (default true, fail-closed) and
  --no-fail-on-partial wired through merge.rs; consumed by the
  partial-fetch pipeline in a later change
- cli::SeverityLevel gains FromStr as the single source of truth for
  level parsing, replacing a hand-rolled match in merge.rs
@nyudenkov
nyudenkov merged commit 3039733 into main Aug 20, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant