Make flake8-bandit work with latest bandit 1.7.3 version

[nastra]

Fixes #21

flake8-bandit 1.7.3 (PyCQA/bandit#496)
introduced an fdata argument.

[sathieu]

I created #23 keeping compatibility with bandit <= 1.7.2.

[Dreamsorcerer]

Maybe update the requirements on this PR to "bandit>=1.7.3" in setup.py? Then the maintainer can choose which PR to use, depending on whether they want to maintain backwards compatibility or not.

[GriceTurrble]

I suggest naming the arguments explicitly, as is being done in #23 :

bnv = BanditNodeVisitor(
    fname=self.filename,
    fdata=None,
    metaast=BanditMetaAst(),
    testset=BanditTestSet(BanditConfig(), profile=config.profile),
    debug=False,
    nosec_lines=[],
    metrics=Metrics(),
)

It costs nothing, makes the call easier to read, and highlights the real root cause of issues in future when/if Bandit changes something again.

[nastra]

good point, updated the code

[GriceTurrble]

I'll copy here as well, I think there needs to be two releases pushed:

• A PATCH update, v2.1.3, that sets the version for bandit<1.7.3 in setup.py (with no other functional change compared to v2.1.2)
• A MINOR update, v2.2.0, that implements the change on this PR and sets bandit>=1.7.3

[Raniz85]

Another possibility would be to detect whether or not fdata is required by using the inspect module.

Something along the lines of:

kwargs = {}
if "fdata" in inspect.signature(BanditNodeVisitor).parameters:
  kwargs["fdata"] = None

bnv = BanditNodeVisitor(
    ....,
    **kwargs
)

Yet another solution would be to get bandit to make fdata default to None in 1.7.4 and then blacklist 1.7.3. This is probably the best solution imo since 1.7.3 introduced breaking changes in a bugfix release (if you follow semver at least).

[carloscorrea93]

Cool 🚀

[staticdev]

LGTM.