[BUG] urllib3 (2.6.3) or chardet (7.0.0)/charset_normalizer (3.4.4) doesn't match a supported version

[ocofaigh]

Using detect-secrets version: 0.13.1+ibm.64.dss we now get this:

Detect secrets............................................................Failed
- hook id: detect-secrets
- exit code: 1
/github/home/.cache/pre-commit/repom69l5rzs/py_env-python3.13/lib/python3.13/site-packages/requests/__init__.py:113: RequestsDependencyWarning: urllib3 (2.6.3) or chardet (7.0.0)/charset_normalizer (3.4.4) doesn't match a supported version!
  warnings.warn(
Traceback (most recent call last):
  File "/github/home/.cache/pre-commit/repom69l5rzs/py_env-python3.13/lib/python3.13/site-packages/detect_secrets/core/secrets_collection.py", line 411, in _extract_secrets_from_file
    plugin.analyze(
    ~~~~~~~~~~~~~~^
        f, filename, self.output_raw,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        self.output_verified_false,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^
    ),
    ^

[jadehartley]

+1

For thread you can workaround to fix pre-commit by pinning it to a lower version in additional_dependencies

-   repo: https://github.com/ibm/detect-secrets
    rev: 0.13.1+ibm.64.dss
    hooks:
    -   id: detect-secrets
        additional_dependencies:
            - boxsdk<4 # https://github.com/IBM/detect-secrets/issues/173
            - chardet<7 # https://github.com/IBM/detect-secrets/issues/182
        description: Detects and manage potential secrets. See
                    `docs/howto/handle-secrets-detection.md` for usage
        args: [--baseline, .secrets.baseline, --use-all-plugins, --fail-on-unaudited]

[raspuchin]

if you are using a project with uv

you can pass
language_version: python3.9
into the hook instead, this seems to work.

[huineng]

this is not the only problem with this tool , we also have the problem with box

ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.
detect-secrets 0.13.1+ibm.64.dss requires boxsdk[jwt]<4.0.0, but you have boxsdk 10.4.0 which is incompatible.

i really have to uninstall detect-secrets and look for alternatives, because this becomes more and more incompatible

[joe-kavanagh]

Is there an ETA for when a fix will be available?

[huineng]

well i think this seems to work for me

uvx --python 3.9 git+https://github.com/ibm/detect-secrets.git@master#egg=detect-secrets scan --exclude-files 'package-lock.json|node_modules/' --update .secrets.baseline

[raspuchin]

@huineng I think you can specify the language version in the hook (works with prek, haven't tried with pre-commit) it's a bit hard to pass a command every time I wanna commit something

[huineng]

yes, i use it like this and it works , for me for the moment all my problems are gone

# This is an example configuration to enable detect-secrets in the pre-commit hook.
# Add this file to the root folder of your repository.
#
# Read pre-commit hook framework https://pre-commit.com/ for more details about the structure of config yaml file and how git pre-commit would invoke each hook.
#
# This line indicates we will use the hook from ibm/detect-secrets to run scan during committing phase.
repos:
  - repo: local
    hooks:
      - id: detect-secrets
        name: detect-secrets
        entry: uvx --python 3.9 git+https://github.com/ibm/detect-secrets.git@master#egg=detect-secrets scan --exclude-files 'package-lock.json|node_modules/' --suppress-unscannable-file-warnings .secrets.baseline
        language: system
        pass_filenames: false