Standardise PR workflow on ci.yml and drop scheduled SBOM scan

Reviewed-on: #26

.gitea/workflows/ci.yml

@@ -0,0 +1,109 @@
+name: CI
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint-and-security:
+    name: lint-and-security
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install Poetry
+        run: pip install "poetry>=2,<3"
+
+      - name: Install dev dependencies (lockfile-pinned pre-commit)
+        run: poetry install --with dev --no-root
+
+      - name: Run pre-commit hooks
+        run: poetry run pre-commit run --all-files --color always
+
+      - name: Install pip-audit
+        run: pip install "pip-audit==2.10.1"
+
+      - name: Audit dependencies (Poetry lockfile)
+        run: |
+          set -euo pipefail
+
+          poetry self add poetry-plugin-export
+          poetry export -f requirements.txt --without-hashes -o requirements-audit.txt
+
+          # pip-audit exits non-zero for ANY vulnerability; capture the report, then gate below.
+          pip-audit --no-deps -r requirements-audit.txt -f json -o pip-audit.json || true
+
+          echo "Fixable vulnerabilities:"
+          jq -r '
+            .dependencies[]?
+            | select(has("vulns"))
+            | . as $d
+            | .vulns[]
+            | select((.fix_versions | length) > 0)
+            | "\($d.name)@\($d.version) -> \(.id) [fix: \(.fix_versions | join(", "))]"
+          ' pip-audit.json
+
+          echo
+          echo "All reported vulnerabilities:"
+          jq -r '
+            .dependencies[]?
+            | select(has("vulns"))
+            | . as $d
+            | .vulns[]
+            | "\($d.name)@\($d.version) -> \(.id) [fix: \(if (.fix_versions | length) > 0 then (.fix_versions | join(", ")) else "none" end)]"
+          ' pip-audit.json
+
+          # Fail only on fixable findings. The type guard ensures a crashed or empty
+          # report fails rather than silently passing. Dependency security updates
+          # are handled by the central Renovate job.
+          jq -e '
+            (.dependencies | type) == "array"
+            and
+            ( [ .dependencies[] | (.vulns // [])[] | select((.fix_versions | length) > 0) ] | length == 0 )
+          ' pip-audit.json
+
+  tests:
+    name: tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.13"]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install Poetry
+        run: pip install "poetry>=2,<3"
+
+      - name: Install project and dependencies
+        run: poetry install --with dev
+
+      - name: Run tests
+        run: poetry run pytest

.gitea/workflows/lint-and-security.yml

@@ -1,36 +0,0 @@
-name: Lint & Security
-
-on:
-  pull_request:
-
-jobs:
-  precommit-and-security:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.13"
-
-      - name: Install pre-commit
-        run: pip install pre-commit
-
-      - name: Run pre-commit hooks
-        run: pre-commit run --all-files --color always
-
-      - name: Install Poetry
-        run: |
-          pip install "poetry>=2,<3"
-          poetry self add poetry-plugin-export
-
-      - name: Install pip-audit
-        run: pip install pip-audit
-
-      - name: Audit dependencies (Poetry lockfile)
-        run: |
-          poetry export -f requirements.txt --without-hashes \
-            | pip-audit -r /dev/stdin

.gitea/workflows/security-scan.yml

@@ -1,188 +0,0 @@
-name: Security Scan
-
-on:
-  schedule:
-    - cron: 27 8 * * *
-  workflow_dispatch:
-
-jobs:
-  security-scan:
-    runs-on: running-man
-
-    env:
-      TARGET_DIR: .
-      COSIGN_VERSION: v3.0.5
-      SYFT_VERSION: v1.42.3
-      GRYPE_VERSION: v0.110.0
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install Cosign (bootstrap)
-        run: |
-          set -euo pipefail
-
-          FILE="cosign-linux-amd64"
-
-          curl -fLO https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/${FILE}
-
-          chmod +x ${FILE}
-          mv ${FILE} /usr/local/bin/cosign
-
-          cosign version
-
-      - name: Install Syft (verified)
-        run: |
-          set -euo pipefail
-
-          VERSION_NO_V="${SYFT_VERSION#v}"
-          FILE="syft_${VERSION_NO_V}_linux_amd64.tar.gz"
-          BASE_URL="https://github.com/anchore/syft/releases/download/${SYFT_VERSION}"
-
-          curl -fLO ${BASE_URL}/${FILE}
-          curl -fLO ${BASE_URL}/syft_${VERSION_NO_V}_checksums.txt
-          curl -fLO ${BASE_URL}/syft_${VERSION_NO_V}_checksums.txt.sig
-          curl -fLO ${BASE_URL}/syft_${VERSION_NO_V}_checksums.txt.pem
-
-          cosign verify-blob \
-            --signature syft_${VERSION_NO_V}_checksums.txt.sig \
-            --certificate syft_${VERSION_NO_V}_checksums.txt.pem \
-            --certificate-identity-regexp "https://github.com/anchore/syft" \
-            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
-            syft_${VERSION_NO_V}_checksums.txt
-
-          CHECKSUM_LINE=$(grep " ${FILE}$" syft_${VERSION_NO_V}_checksums.txt)
-          if [ -z "$CHECKSUM_LINE" ]; then
-            echo "Missing checksum entry for ${FILE}"
-            exit 1
-          fi
-
-          echo "$CHECKSUM_LINE" | sha256sum -c -
-
-          tar -xzf ${FILE}
-          mv syft /usr/local/bin/
-
-          syft version
-
-      - name: Install Grype (verified)
-        run: |
-          set -euo pipefail
-
-          VERSION_NO_V="${GRYPE_VERSION#v}"
-          FILE="grype_${VERSION_NO_V}_linux_amd64.tar.gz"
-          BASE_URL="https://github.com/anchore/grype/releases/download/${GRYPE_VERSION}"
-
-          curl -fLO ${BASE_URL}/${FILE}
-          curl -fLO ${BASE_URL}/grype_${VERSION_NO_V}_checksums.txt
-          curl -fLO ${BASE_URL}/grype_${VERSION_NO_V}_checksums.txt.sig
-          curl -fLO ${BASE_URL}/grype_${VERSION_NO_V}_checksums.txt.pem
-
-          cosign verify-blob \
-            --signature grype_${VERSION_NO_V}_checksums.txt.sig \
-            --certificate grype_${VERSION_NO_V}_checksums.txt.pem \
-            --certificate-identity-regexp "https://github.com/anchore/grype" \
-            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
-            grype_${VERSION_NO_V}_checksums.txt
-
-          CHECKSUM_LINE=$(grep " ${FILE}$" grype_${VERSION_NO_V}_checksums.txt)
-          if [ -z "$CHECKSUM_LINE" ]; then
-            echo "Missing checksum entry for ${FILE}"
-            exit 1
-          fi
-
-          echo "$CHECKSUM_LINE" | sha256sum -c -
-
-          tar -xzf ${FILE}
-          mv grype /usr/local/bin/
-
-          grype version
-
-      - name: Generate SBOM
-        working-directory: ${{ env.TARGET_DIR }}
-        run: |
-          syft dir:. -o json > sbom.json
-
-      - name: Show SBOM contents
-        working-directory: ${{ env.TARGET_DIR }}
-        run: |
-          echo "Packages discovered by Syft:"
-          jq -r '.artifacts[] | "\(.name)@\(.version) [\(.type)]"' sbom.json | sort
-
-      - name: Run Grype scan (JSON)
-        id: audit
-        continue-on-error: true
-        working-directory: ${{ env.TARGET_DIR }}
-        run: |
-          grype sbom:sbom.json -o json > grype.json
-
-          echo "Vulnerabilities (fixable only):"
-          jq -r '
-            .matches[]
-            | select((.vulnerability.fix.versions | length) > 0)
-            | "\(.artifact.name)@\(.artifact.version) -> \(.vulnerability.id) [\(.vulnerability.severity)] | fixed: \(.vulnerability.fix.versions[0])"
-          ' grype.json
-
-          # Fail only on fixable MEDIUM/HIGH/CRITICAL
-          jq -e '
-            [
-              .matches[]?
-              | select(
-                  (
-                    .vulnerability.severity == "Medium" or
-                    .vulnerability.severity == "High" or
-                    .vulnerability.severity == "Critical"
-                  )
-                  and
-                  (
-                    (.vulnerability.fix.versions | length) > 0
-                  )
-                )
-            ]
-            | length == 0
-          ' grype.json
-
-      - name: Show full Grype table
-        working-directory: ${{ env.TARGET_DIR }}
-        run: |
-          echo "Full Grype report:"
-          grype sbom:sbom.json -o table
-
-      - name: Notify Node-RED on vulnerabilities
-        if: steps.audit.outcome == 'failure'
-        working-directory: ${{ env.TARGET_DIR }}
-        run: |
-          jq '
-          {
-            repo: "guardutils/mirro",
-            summary: (
-              "Total: " +
-              (
-                [
-                  .matches[]
-                  | select((.vulnerability.fix.versions | length) > 0)
-                ] | length | tostring
-              )
-            ),
-            vulnerabilities: [
-              .matches[]
-              | select((.vulnerability.fix.versions | length) > 0)
-              | {
-                library: .artifact.name,
-                cve: .vulnerability.id,
-                severity: .vulnerability.severity,
-                installed: .artifact.version,
-                fixed: (.vulnerability.fix.versions[0]),
-                title: .vulnerability.description,
-                url: .vulnerability.dataSource
-              }
-            ]
-          }
-          ' grype.json \
-          | curl -s -X POST https://nodered.sysmd.uk/vulns-alert \
-              -H "Content-Type: application/json" \
-              --data-binary @-
-
-      - name: Fail workflow if vulnerabilities found
-        if: steps.audit.outcome == 'failure'
-        run: exit 1

.github/CODEOWNERS

@@ -0,0 +1 @@
+*   @mdaleo404

.github/FUNDING.yml

@@ -0,0 +1,2 @@
+github: mdaleo404
+ko_fi: mdaleo404

.github/workflows/ci.yml

@@ -0,0 +1,109 @@
+name: CI
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint-and-security:
+    name: lint-and-security
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install Poetry
+        run: pip install "poetry>=2,<3"
+
+      - name: Install dev dependencies (lockfile-pinned pre-commit)
+        run: poetry install --with dev --no-root
+
+      - name: Run pre-commit hooks
+        run: poetry run pre-commit run --all-files --color always
+
+      - name: Install pip-audit
+        run: pip install "pip-audit==2.10.1"
+
+      - name: Audit dependencies (Poetry lockfile)
+        run: |
+          set -euo pipefail
+
+          poetry self add poetry-plugin-export
+          poetry export -f requirements.txt --without-hashes -o requirements-audit.txt
+
+          # pip-audit exits non-zero for ANY vulnerability; capture the report, then gate below.
+          pip-audit --no-deps -r requirements-audit.txt -f json -o pip-audit.json || true
+
+          echo "Fixable vulnerabilities:"
+          jq -r '
+            .dependencies[]?
+            | select(has("vulns"))
+            | . as $d
+            | .vulns[]
+            | select((.fix_versions | length) > 0)
+            | "\($d.name)@\($d.version) -> \(.id) [fix: \(.fix_versions | join(", "))]"
+          ' pip-audit.json
+
+          echo
+          echo "All reported vulnerabilities:"
+          jq -r '
+            .dependencies[]?
+            | select(has("vulns"))
+            | . as $d
+            | .vulns[]
+            | "\($d.name)@\($d.version) -> \(.id) [fix: \(if (.fix_versions | length) > 0 then (.fix_versions | join(", ")) else "none" end)]"
+          ' pip-audit.json
+
+          # Fail only on fixable findings. The type guard ensures a crashed or empty
+          # report fails rather than silently passing. Dependency security updates
+          # are handled by the central Renovate job.
+          jq -e '
+            (.dependencies | type) == "array"
+            and
+            ( [ .dependencies[] | (.vulns // [])[] | select((.fix_versions | length) > 0) ] | length == 0 )
+          ' pip-audit.json
+
+  tests:
+    name: tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.13"]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install Poetry
+        run: pip install "poetry>=2,<3"
+
+      - name: Install project and dependencies
+        run: poetry install --with dev
+
+      - name: Run tests
+        run: poetry run pytest

DEVELOPMENT.md

@@ -63,7 +63,7 @@ poetry.lock                locked dependency graph
 README.md                  user-facing documentation
 LICENCE                    GPL-3.0-or-later licence text
 .pre-commit-config.yaml    Bandit, Black, and generic pre-commit hooks
-.gitea/workflows/          lint, dependency audit, SBOM, and Grype workflows
+.gitea/workflows/          lint and dependency-audit workflows
 dist/                      built release artifacts, not source
 mirro.png                  README logo
 ```
@@ -390,19 +390,6 @@ Gitea pull request workflow:
   -> pip-audit dependency audit
 ```
 
-Scheduled/manual security workflow:
-
-```text
-.gitea/workflows/security-scan.yml
-  -> install Cosign
-  -> verify and install Syft
-  -> verify and install Grype
-  -> generate SBOM
-  -> scan for vulnerabilities
-  -> notify Node-RED on fixable Medium/High/Critical vulnerabilities
-  -> fail workflow on those vulnerabilities
-```
-
 Pre-commit currently includes Bandit, Black, trailing whitespace, EOF, YAML, and TOML checks.
 
 ---

README.md

@@ -169,7 +169,7 @@ Files with history in /foo/bar:
 
 ## Installation
 
-### From GuardUtils package repo
+### From the SysMD package repository
 
 This is the preferred method of installation.
 
@@ -179,7 +179,7 @@ This is the preferred method of installation.
 
 ```bash
 sudo mkdir -p /usr/share/keyrings
-curl -fsSL https://repo.sysmd.uk/guardutils/guardutils.gpg | sudo gpg --dearmor -o /usr/share/keyrings/guardutils.gpg
+curl -fsSL https://repo.sysmd.uk/sysmd/sysmd.gpg | sudo gpg --dearmor -o /usr/share/keyrings/sysmd.gpg
 ```
 
 The GPG fingerprint is `0032C71FA6A11EF9567D4434C5C06BD4603C28B1`.
@@ -187,7 +187,7 @@ The GPG fingerprint is `0032C71FA6A11EF9567D4434C5C06BD4603C28B1`.
 #### 2) Add the APT source
 
 ```bash
-echo "deb [arch=amd64 signed-by=/usr/share/keyrings/guardutils.gpg] https://repo.sysmd.uk/guardutils/debian stable main" | sudo tee /etc/apt/sources.list.d/guardutils.list
+echo "deb [arch=amd64 signed-by=/usr/share/keyrings/sysmd.gpg] https://repo.sysmd.uk/sysmd/debian stable main" | sudo tee /etc/apt/sources.list.d/sysmd.list
 ```
 
 #### 3) Update and install
@@ -202,20 +202,20 @@ sudo apt install mirro
 #### 1) Import the GPG key
 
 ```
-sudo rpm --import https://repo.sysmd.uk/guardutils/guardutils.gpg
+sudo rpm --import https://repo.sysmd.uk/sysmd/sysmd.gpg
 ```
 
 #### 2) Add the repository configuration
 
 ```
-sudo tee /etc/yum.repos.d/guardutils.repo > /dev/null << 'EOF'
+sudo tee /etc/yum.repos.d/sysmd.repo > /dev/null << 'EOF'
-[guardutils]
+[sysmd]
-name=GuardUtils Repository
+name=SysMD Repository
-baseurl=https://repo.sysmd.uk/guardutils/rpm/$basearch
+baseurl=https://repo.sysmd.uk/sysmd/rpm/$basearch
 enabled=1
 gpgcheck=1
 repo_gpgcheck=1
-gpgkey=https://repo.sysmd.uk/guardutils/guardutils.gpg
+gpgkey=https://repo.sysmd.uk/sysmd/sysmd.gpg
 EOF
 ```
 

poetry.lock

@@ -1,15 +1,15 @@
-# This file is automatically @generated by Poetry 2.5.0 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.4.0 and should not be changed by hand.
 
 [[package]]
 name = "argcomplete"
-version = "3.6.3"
+version = "3.7.2"
 description = "Bash tab completion for argparse"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.10"
 groups = ["main"]
 files = [
-    {file = "argcomplete-3.6.3-py3-none-any.whl", hash = "sha256:f5007b3a600ccac5d25bbce33089211dfd49eab4a7718da3f10e3082525a92ce"},
+    {file = "argcomplete-3.7.2-py3-none-any.whl", hash = "sha256:6029205678bdd9c1c728a155f5f9ecf5812393f969eef58807641a2bc2aa5b19"},
-    {file = "argcomplete-3.6.3.tar.gz", hash = "sha256:62e8ed4fd6a45864acc8235409461b72c9a28ee785a2011cc5eb78318786c89c"},
+    {file = "argcomplete-3.7.2.tar.gz", hash = "sha256:aad8b69a0b9969edb62db0d1752354c0d50717b10e0cbb00e2a958381b9fc6b9"},
 ]
 
 [package.extras]
@@ -142,9 +142,6 @@ files = [
     {file = "coverage-7.11.3.tar.gz", hash = "sha256:0f59387f5e6edbbffec2281affb71cdc85e0776c1745150a3ab9b6c1d016106b"},
 ]
 
-[package.dependencies]
-tomli = {version = "*", optional = true, markers = "python_full_version <= \"3.11.0a6\" and extra == \"toml\""}
-
 [package.extras]
 toml = ["tomli ; python_full_version <= \"3.11.0a6\""]
 
@@ -160,25 +157,6 @@ files = [
     {file = "distlib-0.4.0.tar.gz", hash = "sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d"},
 ]
 
-[[package]]
-name = "exceptiongroup"
-version = "1.3.0"
-description = "Backport of PEP 654 (exception groups)"
-optional = false
-python-versions = ">=3.7"
-groups = ["dev"]
-markers = "python_version == \"3.10\""
-files = [
-    {file = "exceptiongroup-1.3.0-py3-none-any.whl", hash = "sha256:4d111e6e0c13d0644cad6ddaa7ed0261a0b36971f6d23e7ec9b4b9097da78a10"},
-    {file = "exceptiongroup-1.3.0.tar.gz", hash = "sha256:b241f5885f560bc56a59ee63ca4c6a8bfa46ae4ad651af316d4e81817bb9fd88"},
-]
-
-[package.dependencies]
-typing-extensions = {version = ">=4.6.0", markers = "python_version < \"3.13\""}
-
-[package.extras]
-test = ["pytest (>=6)"]
-
 [[package]]
 name = "filelock"
 version = "4.0.8"
@@ -277,14 +255,14 @@ testing = ["coverage", "pytest", "pytest-benchmark"]
 
 [[package]]
 name = "pre-commit"
-version = "3.8.0"
+version = "4.6.2"
 description = "A framework for managing and maintaining multi-language pre-commit hooks."
 optional = false
-python-versions = ">=3.9"
+python-versions = ">=3.10"
 groups = ["dev"]
 files = [
-    {file = "pre_commit-3.8.0-py2.py3-none-any.whl", hash = "sha256:9a90a53bf82fdd8778d58085faf8d83df56e40dfe18f45b19446e26bf1b3a63f"},
+    {file = "pre_commit-4.6.2-py2.py3-none-any.whl", hash = "sha256:e2dde9a75d3bce11bd3831c26d134df00a2803c1d818be6a0383c3dcda25dc4e"},
-    {file = "pre_commit-3.8.0.tar.gz", hash = "sha256:8bb6494d4a20423842e198980c9ecf9f96607a07ea29549e180eef9ae80fe7af"},
+    {file = "pre_commit-4.6.2.tar.gz", hash = "sha256:8f5d7bfb021ecdbcd9d49d89847082dd24172ccde534390081a679ad046e2441"},
 ]
 
 [package.dependencies]
@@ -311,38 +289,36 @@ windows-terminal = ["colorama (>=0.4.6)"]
 
 [[package]]
 name = "pytest"
-version = "9.0.3"
+version = "9.1.1"
 description = "pytest: simple powerful testing with Python"
 optional = false
 python-versions = ">=3.10"
 groups = ["dev"]
 files = [
-    {file = "pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9"},
+    {file = "pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c"},
-    {file = "pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c"},
+    {file = "pytest-9.1.1.tar.gz", hash = "sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313"},
 ]
 
 [package.dependencies]
 colorama = {version = ">=0.4", markers = "sys_platform == \"win32\""}
-exceptiongroup = {version = ">=1", markers = "python_version < \"3.11\""}
 iniconfig = ">=1.0.1"
 packaging = ">=22"
 pluggy = ">=1.5,<2"
 pygments = ">=2.7.2"
-tomli = {version = ">=1", markers = "python_version < \"3.11\""}
 
 [package.extras]
 dev = ["argcomplete", "attrs (>=19.2)", "hypothesis (>=3.56)", "mock", "requests", "setuptools", "xmlschema"]
 
 [[package]]
 name = "pytest-cov"
-version = "7.0.0"
+version = "7.1.0"
 description = "Pytest plugin for measuring coverage."
 optional = false
 python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "pytest_cov-7.0.0-py3-none-any.whl", hash = "sha256:3b8e9558b16cc1479da72058bdecf8073661c7f57f7d3c5f22a1c23507f2d861"},
+    {file = "pytest_cov-7.1.0-py3-none-any.whl", hash = "sha256:a0461110b7865f9a271aa1b51e516c9a95de9d696734a2f71e3e78f46e1d4678"},
-    {file = "pytest_cov-7.0.0.tar.gz", hash = "sha256:33c97eda2e049a0c5298e91f519302a1334c26ac65c1a483d6206fd458361af1"},
+    {file = "pytest_cov-7.1.0.tar.gz", hash = "sha256:30674f2b5f6351aa09702a9c8c364f6a01c27aae0c1366ae8016160d1efc56b2"},
 ]
 
 [package.dependencies]
@@ -451,72 +427,6 @@ files = [
     {file = "pyyaml-6.0.3.tar.gz", hash = "sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f"},
 ]
 
-[[package]]
-name = "tomli"
-version = "2.3.0"
-description = "A lil' TOML parser"
-optional = false
-python-versions = ">=3.8"
-groups = ["dev"]
-markers = "python_version == \"3.10\""
-files = [
-    {file = "tomli-2.3.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:88bd15eb972f3664f5ed4b57c1634a97153b4bac4479dcb6a495f41921eb7f45"},
-    {file = "tomli-2.3.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:883b1c0d6398a6a9d29b508c331fa56adbcdff647f6ace4dfca0f50e90dfd0ba"},
-    {file = "tomli-2.3.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d1381caf13ab9f300e30dd8feadb3de072aeb86f1d34a8569453ff32a7dea4bf"},
-    {file = "tomli-2.3.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a0e285d2649b78c0d9027570d4da3425bdb49830a6156121360b3f8511ea3441"},
-    {file = "tomli-2.3.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:0a154a9ae14bfcf5d8917a59b51ffd5a3ac1fd149b71b47a3a104ca4edcfa845"},
-    {file = "tomli-2.3.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:74bf8464ff93e413514fefd2be591c3b0b23231a77f901db1eb30d6f712fc42c"},
-    {file = "tomli-2.3.0-cp311-cp311-win32.whl", hash = "sha256:00b5f5d95bbfc7d12f91ad8c593a1659b6387b43f054104cda404be6bda62456"},
-    {file = "tomli-2.3.0-cp311-cp311-win_amd64.whl", hash = "sha256:4dc4ce8483a5d429ab602f111a93a6ab1ed425eae3122032db7e9acf449451be"},
-    {file = "tomli-2.3.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:d7d86942e56ded512a594786a5ba0a5e521d02529b3826e7761a05138341a2ac"},
-    {file = "tomli-2.3.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:73ee0b47d4dad1c5e996e3cd33b8a76a50167ae5f96a2607cbe8cc773506ab22"},
-    {file = "tomli-2.3.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:792262b94d5d0a466afb5bc63c7daa9d75520110971ee269152083270998316f"},
-    {file = "tomli-2.3.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4f195fe57ecceac95a66a75ac24d9d5fbc98ef0962e09b2eddec5d39375aae52"},
-    {file = "tomli-2.3.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:e31d432427dcbf4d86958c184b9bfd1e96b5b71f8eb17e6d02531f434fd335b8"},
-    {file = "tomli-2.3.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:7b0882799624980785240ab732537fcfc372601015c00f7fc367c55308c186f6"},
-    {file = "tomli-2.3.0-cp312-cp312-win32.whl", hash = "sha256:ff72b71b5d10d22ecb084d345fc26f42b5143c5533db5e2eaba7d2d335358876"},
-    {file = "tomli-2.3.0-cp312-cp312-win_amd64.whl", hash = "sha256:1cb4ed918939151a03f33d4242ccd0aa5f11b3547d0cf30f7c74a408a5b99878"},
-    {file = "tomli-2.3.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:5192f562738228945d7b13d4930baffda67b69425a7f0da96d360b0a3888136b"},
-    {file = "tomli-2.3.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:be71c93a63d738597996be9528f4abe628d1adf5e6eb11607bc8fe1a510b5dae"},
-    {file = "tomli-2.3.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c4665508bcbac83a31ff8ab08f424b665200c0e1e645d2bd9ab3d3e557b6185b"},
-    {file = "tomli-2.3.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4021923f97266babc6ccab9f5068642a0095faa0a51a246a6a02fccbb3514eaf"},
-    {file = "tomli-2.3.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a4ea38c40145a357d513bffad0ed869f13c1773716cf71ccaa83b0fa0cc4e42f"},
-    {file = "tomli-2.3.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:ad805ea85eda330dbad64c7ea7a4556259665bdf9d2672f5dccc740eb9d3ca05"},
-    {file = "tomli-2.3.0-cp313-cp313-win32.whl", hash = "sha256:97d5eec30149fd3294270e889b4234023f2c69747e555a27bd708828353ab606"},
-    {file = "tomli-2.3.0-cp313-cp313-win_amd64.whl", hash = "sha256:0c95ca56fbe89e065c6ead5b593ee64b84a26fca063b5d71a1122bf26e533999"},
-    {file = "tomli-2.3.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:cebc6fe843e0733ee827a282aca4999b596241195f43b4cc371d64fc6639da9e"},
-    {file = "tomli-2.3.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:4c2ef0244c75aba9355561272009d934953817c49f47d768070c3c94355c2aa3"},
-    {file = "tomli-2.3.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c22a8bf253bacc0cf11f35ad9808b6cb75ada2631c2d97c971122583b129afbc"},
-    {file = "tomli-2.3.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0eea8cc5c5e9f89c9b90c4896a8deefc74f518db5927d0e0e8d4a80953d774d0"},
-    {file = "tomli-2.3.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:b74a0e59ec5d15127acdabd75ea17726ac4c5178ae51b85bfe39c4f8a278e879"},
-    {file = "tomli-2.3.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:b5870b50c9db823c595983571d1296a6ff3e1b88f734a4c8f6fc6188397de005"},
-    {file = "tomli-2.3.0-cp314-cp314-win32.whl", hash = "sha256:feb0dacc61170ed7ab602d3d972a58f14ee3ee60494292d384649a3dc38ef463"},
-    {file = "tomli-2.3.0-cp314-cp314-win_amd64.whl", hash = "sha256:b273fcbd7fc64dc3600c098e39136522650c49bca95df2d11cf3b626422392c8"},
-    {file = "tomli-2.3.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:940d56ee0410fa17ee1f12b817b37a4d4e4dc4d27340863cc67236c74f582e77"},
-    {file = "tomli-2.3.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:f85209946d1fe94416debbb88d00eb92ce9cd5266775424ff81bc959e001acaf"},
-    {file = "tomli-2.3.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a56212bdcce682e56b0aaf79e869ba5d15a6163f88d5451cbde388d48b13f530"},
-    {file = "tomli-2.3.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c5f3ffd1e098dfc032d4d3af5c0ac64f6d286d98bc148698356847b80fa4de1b"},
-    {file = "tomli-2.3.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:5e01decd096b1530d97d5d85cb4dff4af2d8347bd35686654a004f8dea20fc67"},
-    {file = "tomli-2.3.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:8a35dd0e643bb2610f156cca8db95d213a90015c11fee76c946aa62b7ae7e02f"},
-    {file = "tomli-2.3.0-cp314-cp314t-win32.whl", hash = "sha256:a1f7f282fe248311650081faafa5f4732bdbfef5d45fe3f2e702fbc6f2d496e0"},
-    {file = "tomli-2.3.0-cp314-cp314t-win_amd64.whl", hash = "sha256:70a251f8d4ba2d9ac2542eecf008b3c8a9fc5c3f9f02c56a9d7952612be2fdba"},
-    {file = "tomli-2.3.0-py3-none-any.whl", hash = "sha256:e95b1af3c5b07d9e643909b5abbec77cd9f1217e6d0bca72b0234736b9fb1f1b"},
-    {file = "tomli-2.3.0.tar.gz", hash = "sha256:64be704a875d2a59753d80ee8a533c3fe183e3f06807ff7dc2232938ccb01549"},
-]
-
-[[package]]
-name = "typing-extensions"
-version = "4.15.0"
-description = "Backported and Experimental Type Hints for Python 3.9+"
-optional = false
-python-versions = ">=3.9"
-groups = ["dev"]
-markers = "python_version == \"3.10\""
-files = [
-    {file = "typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548"},
-    {file = "typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466"},
-]
-
 [[package]]
 name = "virtualenv"
 version = "21.14.2"
@@ -535,9 +445,8 @@ filelock = {version = ">=3.24.2,<5", markers = "python_version >= \"3.10\""}
 packaging = ">=23.1"
 platformdirs = ">=3.9.1,<5"
 python-discovery = ">=1.6"
-typing-extensions = {version = ">=4.13.2", markers = "python_version < \"3.11\""}
 
 [metadata]
 lock-version = "2.1"
-python-versions = ">=3.10,<4.0"
+python-versions = ">=3.11,<4.0"
-content-hash = "badf81e0c865a7a9aed1f2f3390ff4779cf7c50a5ca1ba95b88305acb56bfecb"
+content-hash = "44a3b9a81a4b2009158668ad96dce0e68d268170664ab81513cd4352f475f94a"

pyproject.toml

@@ -1,11 +1,11 @@
 [project]
 name = "mirro"
-version = "0.6.4"
+version = "0.7.1"
 description = "A safe editing wrapper: edits a temp copy, compares, and saves original backup if changed."
 authors = [{ name = "Marco D'Aleo", email = "marco@marcodaleo.com" }]
 license = "GPL-3.0-or-later"
 readme = "README.md"
-requires-python = ">=3.10,<4.0"
+requires-python = ">=3.11,<4.0"
 dependencies = [
     "argcomplete>=2",
 ]
@@ -23,7 +23,7 @@ packages = [{include = "mirro", from = "src"}]
 [tool.poetry.group.dev.dependencies]
 pytest = "^9.0.1"
 pytest-cov = "^7.0.0"
-pre-commit = "^3.8"
+pre-commit = "^4.0.0"
 
 [tool.black]
 line-length = 79