Co-authored-by: Jakob Guldberg Aaes <jakob1379@gmali.com>

Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 6.19.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Fix B613 crash when reading from stdin

The trojansource plugin opened `context.filename` directly as a file,
but when reading from stdin the filename is the sentinel string
`'<stdin>'`, causing a FileNotFoundError.

Use `context.file_data` (the already-opened binary stream) instead of
re-opening the file. This fixes stdin support and avoids an unnecessary
second file open for regular files.

Fixes #1182

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

* Include filename in nosec "no failed test" warning

The warning about a nosec comment with no matching failed test only
included the line number, making it hard to locate the issue in
multi-file scans. Add the filename so the warning reads:

  nosec encountered (B608), but no failed test on file src/foo.py:42

Fixes #1269

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Fix B615 false positive when revision is a variable or expression

When `revision` or `commit_id` is passed as a variable, attribute,
subscript, or other non-literal expression, `get_call_arg_value()`
cannot resolve the actual value. This caused false positives because
the check treated unresolvable values as missing.

Inspect the raw AST keywords before calling `get_call_arg_value()`.
If a `revision` or `commit_id` keyword has a non-Constant value
(Name, Attribute, Subscript, Call, etc.), give the user the benefit
of the doubt and suppress the warning.

Fixes #1345

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

The version guard for deprecated AST node types (Num, Str, Bytes,
Ellipsis, NameConstant) currently activates only on Python >= 3.14,
where these types are removed. However, these types emit
DeprecationWarning on Python 3.12 and 3.13 when accessed via getattr.

Lower the guard from (3, 14) to (3, 12) to avoid triggering
DeprecationWarning on Python 3.12-3.13. The early return behavior is
identical: the node name is known-valid and is returned directly,
skipping the unnecessary getattr call.

B106 (hardcoded_password_funcarg) reported the line of the function
call node rather than the line of the keyword argument containing the
hardcoded password. This made it difficult to locate the actual issue
in multiline calls, and caused `# nosec` placed on the correct line
to be ineffective.

Pass the keyword value's lineno to the Issue so the reported location
points to the actual hardcoded string, not the call.

Fixes #1328

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>