pin pip dependencies to specific version and enable dependabot (#9)

.github/dependabot.yml

@@ -8,3 +8,8 @@ updates:
   schedule:
     interval: daily
   open-pull-requests-limit: 10
+- package-ecosystem: pip
+  directory: "/"
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 10

.gitignore

@@ -1 +1,5 @@
 **/__pycache__/*
+lib/
+bin/
+share/
+pyvenv.cfg

cvereporter/fetch_vulnerabilities.py

@@ -1,19 +1,13 @@
 #!/usr/bin/env python3
 
-import argparse
 import json
 import requests
 from bs4 import BeautifulSoup
 from datetime import datetime
-from cyclonedx.model.impact_analysis import ImpactAnalysisAffectedStatus
 from cyclonedx.model.vulnerability import (
     Vulnerability,
     VulnerabilitySource,
-    VulnerabilityScoreSource,
-    VulnerabilityRating,
-    VulnerabilitySeverity,
     BomTarget,
-    BomTargetVersionRange,
 )
 
 """

cvereporter/nist_enhance.py

@@ -1,12 +1,8 @@
-from cyclonedx.model.impact_analysis import ImpactAnalysisAffectedStatus
 from cyclonedx.model.vulnerability import (
     Vulnerability,
     VulnerabilitySource,
     VulnerabilityScoreSource,
     VulnerabilityRating,
-    VulnerabilitySeverity,
-    BomTarget,
-    BomTargetVersionRange,
 )
 import requests
 import json

cvereporter/report.py

@@ -1,6 +1,5 @@
-from cyclonedx.exception import MissingOptionalDependencyException
 from cyclonedx.factory.license import LicenseFactory
-from cyclonedx.model import OrganizationalEntity, XsUri, ExternalReferenceType
+from cyclonedx.model import XsUri, ExternalReferenceType
 from cyclonedx.model.bom import Bom
 from cyclonedx.model.component import Component, ComponentType, ExternalReference
 from cyclonedx.model.impact_analysis import ImpactAnalysisAffectedStatus
@@ -14,8 +13,6 @@
     BomTargetVersionRange,
 )
 from cyclonedx.output.json import JsonV1Dot4
-from cyclonedx.schema import SchemaVersion, OutputFormat
-from cyclonedx.validation.json import JsonStrictValidator
 from datetime import datetime
 
 """

ojvg_convert.py

@@ -1,5 +1,5 @@
 import json
-from cve_pipeline import fetch_vulnerabilities, report, nist_enhance
+from cvereporter import fetch_vulnerabilities, report, nist_enhance
 
 """
 This file will take a downloaded version of all the CVEs from OJVG which are retrieved by ojvg_download.py and enhance with NIST data, resulting in the creation of the VDR.

requirements.txt

@@ -1,5 +1,3 @@
-beautifulsoup4
-requests
-cyclonedx-python-lib
-pytest
-black
+beautifulsoup4==4.12.3
+cyclonedx-python-lib===7.3.1
+requests==2.31.0