update lock file

.github/workflows/CI.yaml

@@ -15,16 +15,16 @@ jobs:
     name: Python ${{ matrix.python-version }}
     steps:
     - uses: actions/checkout@v4
-    - uses: actions/setup-python@v4
+    - uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
         architecture: x64
     - name: Setting up PDM
-      uses: pdm-project/setup-pdm@v2
+      uses: pdm-project/setup-pdm@v3
       with:
         python-version: ${{ matrix.python-version }}
     - name: Setting up NOX
-      uses: wntrblm/nox@2022.11.21
+      uses: wntrblm/nox@2023.04.22
       with:
         python-versions: ${{ matrix.python-version }}
     - name: "Linting tests"

noxfile.py

@@ -40,13 +40,14 @@ def fmt(session: nox.Session) -> None:
 
 @nox.session(python=PYTHON_VERSIONS[-1], tags=["lint"])
 def lint(session: nox.Session) -> None:
-    """Checks the source code for programmatic and stylistic errors."""
+    """Checks the source code for programmatic, stylistic and security violations."""
     args = session.posargs or LOCATIONS
     session.run("pdm", "install", "--group", "lint", external=True)
     session.run("isort", "--check-only", *args)
     session.run("black", "--check", *args)
     session.run("ruff", *args)
     session.run("yamllint", *args)
+    session.run("bandit", "-q", "-c", "pyproject.toml", "-r", *args, external=True)
 
 
 @nox.session(python=PYTHON_VERSIONS[-1], tags=["check"])

pyproject.toml

@@ -32,6 +32,7 @@ lint = [
     "pyright>=1.1.295",
     "yamllint>=1.29.0",
     "nox>=2022.11.21",
+    "bandit>=1.7.6",
 ]
 test = [
     "pygments>=2.14.0",
@@ -63,6 +64,9 @@ convention = "google"
 [tool.ruff.flake8-quotes]
 docstring-quotes = "double"
 
+[tool.bandit]
+exclude_dirs = [".venv", "tests/**"]
+
 [tool.pyright]
 pythonVersion = "3.10"
 reportInvalidStringEscapeSequence = false