[pre-commit.ci] pre-commit autoupdate

.pre-commit-config.yaml

@@ -5,7 +5,7 @@ repos:
       - id: end-of-file-fixer
       - id: trailing-whitespace
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.28.5
+    rev: 0.28.6
     hooks:
       - id: check-github-workflows
         args: [ "--verbose" ]
@@ -20,11 +20,11 @@ repos:
       - id: tox-ini-fmt
         args: ["-p", "fix"]
   - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: "2.1.3"
+    rev: "2.1.4"
     hooks:
       - id: pyproject-fmt
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: "v0.4.10"
+    rev: "v0.5.0"
     hooks:
       - id: ruff-format
       - id: ruff

docs/conf.py

@@ -52,7 +52,7 @@ def setup(app):
     root, exe = here.parent, Path(sys.executable)
     towncrier = exe.with_name(f"towncrier{exe.suffix}")
     cmd = [str(towncrier), "build", "--draft", "--version", "NEXT"]
-    new = subprocess.check_output(cmd, cwd=root, text=True, stderr=subprocess.DEVNULL, encoding="UTF-8")  # noqa: S603
+    new = subprocess.check_output(cmd, cwd=root, text=True, stderr=subprocess.DEVNULL, encoding="UTF-8")
     (root / "docs" / "_draft.rst").write_text("" if "No significant changes" in new else new, encoding="UTF-8")
 
     # the CLI arguments are dynamically generated

pyproject.toml

@@ -129,6 +129,7 @@ lint.ignore = [
   "PTH",     # no pathlib, <=39 has problems on Windows with absolute/resolve, can revisit once we no longer need 39
   "S104",    # Possible binding to all interfaces
   "S404",    # Using subprocess is alright
+  "S603",    # subprocess calls are fine
 ]
 lint.per-file-ignores."tests/**/*.py" = [
   "D",       # don't care about documentation in tests

src/virtualenv/create/via_global_ref/builtin/cpython/mac_os.py

@@ -121,7 +121,7 @@ def fix_mach_o(exe, current, new, max_size):
         logging.warning("Could not call _builtin_change_mac_o: %s. Trying to call install_name_tool instead.", e)
         try:
             cmd = ["install_name_tool", "-change", current, new, exe]
-            subprocess.check_call(cmd)  # noqa: S603
+            subprocess.check_call(cmd)
         except Exception:
             logging.fatal("Could not call install_name_tool -- you must have Apple's development tools installed")
             raise

src/virtualenv/discovery/cached_py_info.py

@@ -112,7 +112,7 @@ def _run_subprocess(cls, exe, app_data, env):
         logging.debug("get interpreter info via cmd: %s", LogCmd(cmd))
         try:
             process = Popen(
-                cmd,  # noqa: S603
+                cmd,
                 universal_newlines=True,
                 stdin=subprocess.PIPE,
                 stderr=subprocess.PIPE,

src/virtualenv/seed/embed/pip_invoke.py

@@ -24,7 +24,7 @@ def run(self, creator):
     @staticmethod
     def _execute(cmd, env):
         logging.debug("pip seed by running: %s", LogCmd(cmd, env))
-        process = Popen(cmd, env=env)  # noqa: S603
+        process = Popen(cmd, env=env)
         process.communicate()
         if process.returncode != 0:
             msg = f"failed seed with code {process.returncode}"

src/virtualenv/seed/embed/via_app_data/pip_install/symlink.py

@@ -16,7 +16,7 @@ def _sync(self, src, dst):
     def _generate_new_files(self):
         # create the pyc files, as the build image will be R/O
         cmd = [str(self._creator.exe), "-m", "compileall", str(self._image_dir)]
-        process = Popen(cmd, stdout=PIPE, stderr=PIPE)  # noqa: S603
+        process = Popen(cmd, stdout=PIPE, stderr=PIPE)
         process.communicate()
         # the root pyc is shared, so we'll not symlink that - but still add the pyc files to the RECORD for close
         root_py_cache = self._image_dir / "__pycache__"

src/virtualenv/seed/wheels/acquire.py

@@ -69,7 +69,7 @@ def download_wheel(distribution, version_spec, for_py_version, search_dirs, app_
     ]
     # pip has no interface in python - must be a new sub-process
     env = pip_wheel_env_run(search_dirs, app_data, env)
-    process = Popen(cmd, env=env, stdout=PIPE, stderr=PIPE, universal_newlines=True, encoding="utf-8")  # noqa: S603
+    process = Popen(cmd, env=env, stdout=PIPE, stderr=PIPE, universal_newlines=True, encoding="utf-8")
     out, err = process.communicate()
     if process.returncode != 0:
         kwargs = {"output": out, "stderr": err}

src/virtualenv/seed/wheels/periodic_update.py

@@ -219,7 +219,7 @@ def trigger_update(distribution, for_py_version, wheel, search_dirs, app_data, e
     kwargs = {"stdout": pipe, "stderr": pipe}
     if not debug and sys.platform == "win32":
         kwargs["creationflags"] = CREATE_NO_WINDOW
-    process = Popen(cmd, **kwargs)  # noqa: S603
+    process = Popen(cmd, **kwargs)
     logging.info(
         "triggered periodic upgrade of %s%s (for python %s) via background process having PID %d",
         distribution,

src/virtualenv/util/subprocess/__init__.py

@@ -8,7 +8,7 @@
 def run_cmd(cmd):
     try:
         process = subprocess.Popen(
-            cmd,  # noqa: S603
+            cmd,
             universal_newlines=True,
             stdin=subprocess.PIPE,
             stderr=subprocess.PIPE,

tasks/make_zipapp.py

@@ -239,7 +239,7 @@ def _build_sdist(self, folder, target):
 
 def run_suppress_output(cmd, stop_print_on_fail=False):  # noqa: FBT002
     process = subprocess.Popen(
-        cmd,  # noqa: S603
+        cmd,
         stdout=subprocess.PIPE,
         stderr=subprocess.PIPE,
         universal_newlines=True,

tasks/release.py

@@ -54,7 +54,7 @@ def get_upstream(repo: Repo) -> Remote:
 
 def release_changelog(repo: Repo, version: Version) -> Commit:
     print("generate release commit")  # noqa: T201
-    check_call(["towncrier", "build", "--yes", "--version", version.public], cwd=str(ROOT_SRC_DIR))  # noqa: S603, S607
+    check_call(["towncrier", "build", "--yes", "--version", version.public], cwd=str(ROOT_SRC_DIR))  # noqa: S607
     return repo.index.commit(f"release {version}")
 
 

tasks/upgrade_wheels.py

@@ -21,7 +21,7 @@
 
 def download(ver, dest, package):
     subprocess.call(
-        [  # noqa: S603
+        [
             sys.executable,
             "-m",
             "pip",
@@ -121,11 +121,11 @@ def get_embed_wheel(distribution, for_py_version):
         dest_target.write_text(msg, encoding="utf-8")
 
         subprocess.run(
-            [sys.executable, "-m", "ruff", "check", str(dest_target), "--fix", "--unsafe-fixes"],  # noqa: S603
+            [sys.executable, "-m", "ruff", "check", str(dest_target), "--fix", "--unsafe-fixes"],
             check=False,
         )
         subprocess.run(
-            [sys.executable, "-m", "ruff", "format", str(dest_target), "--preview"],  # noqa: S603
+            [sys.executable, "-m", "ruff", "format", str(dest_target), "--preview"],
             check=False,
         )