nebius/SWE-bench-extra huggingface dataset:
Repository: tox-dev/tox

Issue:
PYTHONPATH leaks into "envreport"
Pretty trivial bug.
Even though tox discards PYTHONPATH for `pip install`, it does not discard it for `pip freeze`, causing garbage output if PYTHONPATH has any extra packages (i.e. "pip freeze" will see packages from PYTHONPATH, which it should not do).

https://github.com/tox-dev/tox/blob/3.27.0/src/tox/venv.py#L843

Fix is trivial - fetch env and apply `ensure_pip_os_environ_ok` the same way it is done for `pip install`, pass env to pcall. I will make a PR.


Comments:

Patch:
diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index e0259323..09ae1344 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -33,6 +33,7 @@ Cyril Roelandt
 Dane Hillard
 David Staheli
 David Diaz
+Dmitrii Sutiagin a.k.a. f3flight
 Ederag
 Eli Collins
 Eugene Yunak
diff --git a/docs/changelog/2528.bugfix.rst b/docs/changelog/2528.bugfix.rst
new file mode 100644
index 00000000..c5cecd41
--- /dev/null
+++ b/docs/changelog/2528.bugfix.rst
@@ -0,0 +1,1 @@
+Add env cleanup to envreport - fix PYTHONPATH leak into "envreport" -- by :user:`f3flight`.
diff --git a/src/tox/venv.py b/src/tox/venv.py
index 8acb0c77..47f281f6 100644
--- a/src/tox/venv.py
+++ b/src/tox/venv.py
@@ -840,7 +840,11 @@ def tox_runtest_post(venv):
 def tox_runenvreport(venv, action):
     # write out version dependency information
     args = venv.envconfig.list_dependencies_command
-    output = venv._pcall(args, cwd=venv.envconfig.config.toxinidir, action=action, returnout=True)
+    env = venv._get_os_environ()
+    venv.ensure_pip_os_environ_ok(env)
+    output = venv._pcall(
+        args, cwd=venv.envconfig.config.toxinidir, action=action, returnout=True, env=env
+    )
     # the output contains a mime-header, skip it
     output = output.split("\n\n")[-1]
     packages = output.strip().split("\n")


Test patch:
diff --git a/tests/unit/test_venv.py b/tests/unit/test_venv.py
index aa78a48b..3da4e22e 100644
--- a/tests/unit/test_venv.py
+++ b/tests/unit/test_venv.py
@@ -14,6 +14,7 @@ from tox.venv import (
     VirtualEnv,
     getdigest,
     prepend_shebang_interpreter,
+    tox_runenvreport,
     tox_testenv_create,
     tox_testenv_install_deps,
 )
@@ -1233,3 +1234,17 @@ def test_path_change(tmpdir, mocksession, newconfig, monkeypatch):
         path = x.env["PATH"]
         assert os.environ["PATH"] in path
         assert path.endswith(str(venv.envconfig.config.toxinidir) + "/bin")
+
+
+def test_runenvreport_pythonpath_discarded(newmocksession, mocker):
+    mock_os_environ = mocker.patch("tox.venv.VirtualEnv._get_os_environ")
+    mocksession = newmocksession([], "")
+    venv = mocksession.getvenv("python")
+    mock_os_environ.return_value = dict(PYTHONPATH="/some/path/")
+    mock_pcall = mocker.patch.object(venv, "_pcall")
+    tox_runenvreport(venv, None)
+    try:
+        env = mock_pcall.mock_calls[0].kwargs["env"]
+    except TypeError:  # older pytest (python 3.7 and below)
+        env = mock_pcall.mock_calls[0][2]["env"]
+    assert "PYTHONPATH" not in env
Repository: tox-dev/tox

Issue:
change_dir fails if directory does not exist
        I found the issue I think: `change_dir` says that the directory is created if it doesn't exist, but that does not seem to be the case:

> Change to this working directory when executing the test command. If the directory does not exist yet, it will be created (required for Windows to be able to execute any command).

with `change_dir = foo` the tests don't run and show the error above.

When I do `mkdir foo` myself before, it works.

_Originally posted by @maxnoe in https://github.com/tox-dev/tox/issues/2612#issuecomment-1341515799_
      

Comments:

Patch:
diff --git a/docs/changelog/2620.bugfix.rst b/docs/changelog/2620.bugfix.rst
new file mode 100644
index 00000000..ba4c5bd5
--- /dev/null
+++ b/docs/changelog/2620.bugfix.rst
@@ -0,0 +1,1 @@
+Ensure :ref:`change_dir` is created if does not exist before executing :ref:`commands` - by :user:`gaborbernat`.
diff --git a/src/tox/session/cmd/run/single.py b/src/tox/session/cmd/run/single.py
index 9cc3e45e..9ef909d1 100644
--- a/src/tox/session/cmd/run/single.py
+++ b/src/tox/session/cmd/run/single.py
@@ -71,6 +71,7 @@ def run_commands(tox_env: RunToxEnv, no_test: bool) -> tuple[int, list[Outcome]]
         from tox.plugin.manager import MANAGER  # importing this here to avoid circular import
 
         chdir: Path = tox_env.conf["change_dir"]
+        chdir.mkdir(exist_ok=True, parents=True)
         ignore_errors: bool = tox_env.conf["ignore_errors"]
         MANAGER.tox_before_run_commands(tox_env)
         status_pre, status_main, status_post = -1, -1, -1


Test patch:
diff --git a/tests/tox_env/test_tox_env_api.py b/tests/tox_env/test_tox_env_api.py
index c5542dbc..2c467bb6 100644
--- a/tests/tox_env/test_tox_env_api.py
+++ b/tests/tox_env/test_tox_env_api.py
@@ -86,3 +86,10 @@ def test_tox_env_pass_env_match_ignore_case(char: str, glob: str) -> None:
     with patch("os.environ", {"A1": "1", "a2": "2", "A2": "3", "B": "4"}):
         env = ToxEnv._load_pass_env([f"{char}{glob}"])
     assert env == {"A1": "1", "a2": "2", "A2": "3"}
+
+
+def test_change_dir_is_created_if_not_exist(tox_project: ToxProjectCreator) -> None:
+    prj = tox_project({"tox.ini": "[testenv]\npackage=skip\nchange_dir=a{/}b\ncommands=python --version"})
+    result_first = prj.run("r")
+    result_first.assert_success()
+    assert (prj.path / "a" / "b").exists()
Repository: tox-dev/tox

Issue:
tox quickstart: error: the following arguments are required: root
## Issue

I ran `tox quickstart` as described in https://tox.wiki/en/latest/user_guide.html.

and get the error `tox quickstart: error: the following arguments are required: root`.

It seems that either the default parameter that should select the current working environment seems to be broken or the documentation should be updated.

## Environment

Provide at least:

- OS: Windows 11

<details open>
<summary>Output of <code>pip list</code> of the host Python, where <code>tox</code> is installed</summary>

```console
Python version: 3.11
Packages: No idea, I installed with pipx
```

</details>

Thanks a lot for developing this super useful library!


Comments:

Patch:
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index e78e4b05..c93da511 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -5,7 +5,7 @@ repos:
       - id: end-of-file-fixer
       - id: trailing-whitespace
   - repo: https://github.com/psf/black
-    rev: 23.7.0
+    rev: 23.9.1
     hooks:
       - id: black
   - repo: https://github.com/codespell-project/codespell
diff --git a/docs/changelog/3084.bugfix.rst b/docs/changelog/3084.bugfix.rst
new file mode 100644
index 00000000..687acbd1
--- /dev/null
+++ b/docs/changelog/3084.bugfix.rst
@@ -0,0 +1,1 @@
+Fix ``quickstart`` command from requiring ``root`` positional argument
diff --git a/src/tox/session/cmd/quickstart.py b/src/tox/session/cmd/quickstart.py
index 30802399..575a5223 100644
--- a/src/tox/session/cmd/quickstart.py
+++ b/src/tox/session/cmd/quickstart.py
@@ -27,6 +27,7 @@ def tox_add_option(parser: ToxParser) -> None:
         "quickstart_root",
         metavar="root",
         default=Path().absolute(),
+        nargs="?",
         help="folder to create the tox.ini file",
         type=Path,
     )


Test patch:
diff --git a/tests/session/cmd/test_quickstart.py b/tests/session/cmd/test_quickstart.py
index 6effff29..f4672caf 100644
--- a/tests/session/cmd/test_quickstart.py
+++ b/tests/session/cmd/test_quickstart.py
@@ -53,3 +53,8 @@ def test_quickstart_refuse(tox_project: ToxProjectCreator) -> None:
 def test_quickstart_help(tox_project: ToxProjectCreator) -> None:
     outcome = tox_project({"tox.ini": ""}).run("q", "-h")
     outcome.assert_success()
+
+
+def test_quickstart_no_args(tox_project: ToxProjectCreator) -> None:
+    outcome = tox_project({}).run("q")
+    outcome.assert_success()
Repository: tsroten/dragonmapper

Issue:
AttributeError: 'module' object has no attribute 'hanzi'
Hey! I'm trying to use dragonmapper and I'm getting a confusing error. I installed it on Ubuntu 16.04 with the following command:

`pip install dragonmapper --user`

Then tried to use it:

```
import dragonmapper
dragonmapper.hanzi.is_simplified(u'你好')
```

but get the following error:
`AttributeError: 'module' object has no attribute 'hanzi'`

python --version outputs:
`Python 2.7.12`

What's up?


Comments:

Patch:
diff --git a/docs/index.rst b/docs/index.rst
index 558b17c..310ad40 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -15,6 +15,7 @@ functions for Chinese text processing:
 
 .. code:: python
 
+    >>> import dragonmapper.hanzi
     >>> s = '我是一个美国人。'
     >>> dragonmapper.hanzi.is_simplified(s)
     True
@@ -25,6 +26,7 @@ functions for Chinese text processing:
 
 .. code:: python
 
+    >>> import dragonmapper.transcriptions
     >>> s = 'Wǒ shì yīgè měiguórén.'
     >>> dragonmapper.transcriptions.is_pinyin(s)
     True
diff --git a/dragonmapper/data/transcriptions.csv b/dragonmapper/data/transcriptions.csv
index 6447017..072be78 100644
--- a/dragonmapper/data/transcriptions.csv
+++ b/dragonmapper/data/transcriptions.csv
@@ -234,6 +234,7 @@ nun,ㄋㄨㄣ,nwən
 nuo,ㄋㄨㄛ,nwɔ
 nü,ㄋㄩ,ny
 nüe,ㄋㄩㄝ,nɥœ
+o,ㄛ,ɔ
 ou,ㄡ,oʊ
 pa,ㄆㄚ,pʰa
 pai,ㄆㄞ,pʰaɪ


Test patch:
diff --git a/dragonmapper/tests/test-transcriptions.py b/dragonmapper/tests/test-transcriptions.py
index a4d5e14..04a5733 100644
--- a/dragonmapper/tests/test-transcriptions.py
+++ b/dragonmapper/tests/test-transcriptions.py
@@ -173,3 +173,9 @@ class TestConvertFunctions(unittest.TestCase):
         numbered = 'Ao4di4li4'
 
         self.assertEqual(numbered, trans.accented_to_numbered(accented))
+
+    def test_issue_23(self):
+        pinyin = 'ó'
+        zhuyin = 'ㄛˊ'
+
+        self.assertEqual(zhuyin, trans.pinyin_to_zhuyin(pinyin))
Repository: twu/skjold

Issue:
Links to pyup.io point to 404 page
Here's an example of an issue reported by skjold:
```
cryptography==38.0.1 (<39.0.0) via pyup as pyup.io-51159 found in poetry.lock

Cryptography 39.0.0 drops support for C library "LibreSSL" < 3.4, as these
versions are not receiving security support anymore.
https://pyup.io/pyup.io-51159
```
The link at the last line points to https://pyup.io/pyup.io-51159, however it should point to https://pyup.io/vulnerabilities/CVE-2021-41581/51159/

It's likely appending the `id` instead of the `more_info_path` to the domain when constructing the link.

Comments:

Patch:
diff --git a/src/skjold/sources/pyup.py b/src/skjold/sources/pyup.py
index 5df83b3..d41755c 100644
--- a/src/skjold/sources/pyup.py
+++ b/src/skjold/sources/pyup.py
@@ -36,7 +36,10 @@ class PyUpSecurityAdvisory(SecurityAdvisory):
 
     @property
     def url(self) -> str:
-        return f"https://pyup.io/{self.identifier}"
+        path = self._json.get("more_info_path")
+        if not path:
+            return ""
+        return f"https://pyup.io{path}"
 
     @property
     def references(self) -> List[str]:


Test patch:
diff --git a/tests/test_pyup.py b/tests/test_pyup.py
index 8508def..828c019 100644
--- a/tests/test_pyup.py
+++ b/tests/test_pyup.py
@@ -10,7 +10,7 @@ from skjold.sources.pyup import PyUp, PyUpSecurityAdvisory
 
 
 @pytest.mark.parametrize(
-    "name, raw",
+    "name, raw, expected_url",
     [
         (
             "package_name",
@@ -21,10 +21,25 @@ from skjold.sources.pyup import PyUp, PyUpSecurityAdvisory
                 "specs": ["<1.0.0", ">=1.1,<1.1.1"],
                 "v": "<1.0.4,>=1.1,<1.1.1",
             },
-        )
+            "",
+        ),
+        (
+            "package_name",
+            {
+                "advisory": "Advisory summary.",
+                "cve": "CVE-200X-XXXX",
+                "id": "pyup.io-XXXXXX",
+                "specs": ["<1.0.0", ">=1.1,<1.1.1"],
+                "v": "<1.0.4,>=1.1,<1.1.1",
+                "more_info_path": "/vulnerabilities/CVE-1970-0001/12345/",
+            },
+            "https://pyup.io/vulnerabilities/CVE-1970-0001/12345/",
+        ),
     ],
 )
-def test_ensure_using_build_obj(name: str, raw: Dict[Any, Any]) -> None:
+def test_ensure_using_build_obj(
+    name: str, raw: Dict[Any, Any], expected_url: str
+) -> None:
     obj = PyUpSecurityAdvisory.using(name, raw)
     assert obj.package_name == "package_name"
     assert obj.canonical_name == "package-name"
@@ -32,7 +47,7 @@ def test_ensure_using_build_obj(name: str, raw: Dict[Any, Any]) -> None:
     assert obj.source == "pyup"
     assert obj.summary == "Advisory summary."
     assert obj.severity == "UNKNOWN"
-    assert obj.url == "https://pyup.io/pyup.io-XXXXXX"
+    assert obj.url == expected_url
     assert obj.references == []
     assert obj.vulnerable_versions == "<1.0.0,<1.1.1,>=1.1"
Repository: twu/skjold

Issue:
Inconsequent ignoring
Let's take a look at this example:

```
% echo "py==1.11.0" | skjold audit -s pyup -s gemnasium -
Warning: No advisory sources configured!

py==1.11.0 (<=1.11.0) via gemnasium as CVE-2022-42969 found in <stdin>

Regular expression Denial of Service. The py library through 1.11.0 for Python
allows remote attackers to conduct a ReDoS (Regular expression Denial of
Service) attack via a Subversion repository with crafted info data, because the
InfoSvnCommand argument is mishandled.
https://nvd.nist.gov/vuln/detail/CVE-2022-42969

https://nvd.nist.gov/vuln/detail/CVE-2022-42969
https://pypi.org/project/py
https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316
https://github.com/pytest-dev/py/issues/287
--

py==1.11.0 (<=1.11.0) via pyup as pyup.io-51457 found in <stdin>

Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular
expression Denial of Service) attack via a Subversion repository with crafted
info data, because the InfoSvnCommand argument is mishandled.
https://github.com/pytest-dev/py/issues/287
https://pyup.io/vulnerabilities/CVE-2022-42969/51457/

--
Found 1 vulnerable package(s)!
```

Both `pyup` and `gemnasium` finds this package as a vulnerability. However when using `pyup` as a source, it's identified as `pyup.io-51457`, not as `CVE-2022-42969`, like it is when using `gemnasium`. Thus, if you want to ignore this finding, you will have to run `skjold ignore py CVE-2022-42969` and `skjold ignore py pyup.io-51457` to ignore both of these.

I'm guessing there's just some error (or inconsistency) in how the data from `pyup` is parsed, as the raw data contains the CVE. 

Changing this behaviour can of course break some existing ignore files, but would still be nice if it would work intuitively and following the examples on how to ignore the finding.

Comments:

Patch:
diff --git a/src/skjold/sources/pyup.py b/src/skjold/sources/pyup.py
index d41755c..65f963a 100644
--- a/src/skjold/sources/pyup.py
+++ b/src/skjold/sources/pyup.py
@@ -24,7 +24,7 @@ class PyUpSecurityAdvisory(SecurityAdvisory):
 
     @property
     def identifier(self) -> str:
-        return self._json["id"]
+        return self._json["cve"]
 
     @property
     def source(self) -> str:


Test patch:
diff --git a/tests/test_pyup.py b/tests/test_pyup.py
index 828c019..eaa7830 100644
--- a/tests/test_pyup.py
+++ b/tests/test_pyup.py
@@ -43,7 +43,7 @@ def test_ensure_using_build_obj(
     obj = PyUpSecurityAdvisory.using(name, raw)
     assert obj.package_name == "package_name"
     assert obj.canonical_name == "package-name"
-    assert obj.identifier == "pyup.io-XXXXXX"
+    assert obj.identifier == "CVE-200X-XXXX"
     assert obj.source == "pyup"
     assert obj.summary == "Advisory summary."
     assert obj.severity == "UNKNOWN"
@@ -144,7 +144,7 @@ def pyup_advisories_with_metadata() -> Any:
       },
       "package": [{
         "advisory": "...",
-        "cve": null,
+        "cve": "CVE-200X-XXXX",
         "id": "pyup.io-XXXXX",
         "specs": [">0", "<0"],
         "v": ">0,<0"
Repository: tylerwince/pydbg

Issue:
Parentheses aren't displayed correctly for functions
The closing parentheses around the function call is missing.
```
In [19]: def add(x, y):
    ...:     z = x + y
    ...:     return z
    ...:

In [20]: dbg(add(1, 2))
[<ipython-input-20-ac7b28727082>:1] add(1, 2 = 3
```

Comments:

Patch:
diff --git a/.travis.yml b/.travis.yml
index e1b9f62..0b6f2c8 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ python:
   - "nightly"
 # command to install dependencies
 install:
-  - pip install pydbg
+  - pip install -e .
 # command to run tests
 script:
   - pytest -vv
diff --git a/pydbg.py b/pydbg.py
index 3695ef8..a5b06df 100644
--- a/pydbg.py
+++ b/pydbg.py
@@ -27,7 +27,10 @@ def dbg(exp):
     for i in reversed(inspect.stack()):
         if "dbg" in i.code_context[0]:
             var_name = i.code_context[0][
-                i.code_context[0].find("(") + 1 : i.code_context[0].find(")")
+                i.code_context[0].find("(")
+                + 1 : len(i.code_context[0])
+                - 1
+                - i.code_context[0][::-1].find(")")
             ]
             print(f"[{i.filename}:{i.lineno}] {var_name} = {exp}")
             break


Test patch:
diff --git a/tests/test_pydbg.py b/tests/test_pydbg.py
index 5b12508..bf91ea4 100644
--- a/tests/test_pydbg.py
+++ b/tests/test_pydbg.py
@@ -4,9 +4,6 @@ from pydbg import dbg
 from contextlib import redirect_stdout
 
 
-def something():
-    pass
-
 cwd = os.getcwd()
 
 def test_variables():
@@ -23,12 +20,19 @@ def test_variables():
         dbg(strType)
         dbg(boolType)
         dbg(NoneType)
+        dbg(add(1, 2))
 
-    want = f"""[{cwd}/tests/test_pydbg.py:21] intType = 2
-[{cwd}/tests/test_pydbg.py:22] floatType = 2.1
-[{cwd}/tests/test_pydbg.py:23] strType = mystring
-[{cwd}/tests/test_pydbg.py:24] boolType = True
-[{cwd}/tests/test_pydbg.py:25] NoneType = None
+    want = f"""[{cwd}/tests/test_pydbg.py:18] intType = 2
+[{cwd}/tests/test_pydbg.py:19] floatType = 2.1
+[{cwd}/tests/test_pydbg.py:20] strType = mystring
+[{cwd}/tests/test_pydbg.py:21] boolType = True
+[{cwd}/tests/test_pydbg.py:22] NoneType = None
+[{cwd}/tests/test_pydbg.py:23] add(1, 2) = 3
 """
 
-    assert out.getvalue() == want
+    assert out.getvalue()  == want
+
+
+def add(x, y):
+    return x + y
+