From 34e878d2e78b41976dd0503c769027fa1ac8b631 Mon Sep 17 00:00:00 2001
From: Ruben Romero Montes <rromerom@redhat.com>
Date: Mon, 20 Apr 2026 23:07:02 +0200
Subject: [PATCH] fix(python): add --quiet flag to pip report command

Suppresses pip progress messages on stdout that contaminate the JSON
report output, causing Jackson parse errors on pyproject.toml analysis.

Implements TC-4164

Assisted-by: Claude Code
---
 .../guacsec/trustifyda/providers/PythonPyprojectProvider.java | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/main/java/io/github/guacsec/trustifyda/providers/PythonPyprojectProvider.java b/src/main/java/io/github/guacsec/trustifyda/providers/PythonPyprojectProvider.java
index 37c242a5..561b5c92 100644
--- a/src/main/java/io/github/guacsec/trustifyda/providers/PythonPyprojectProvider.java
+++ b/src/main/java/io/github/guacsec/trustifyda/providers/PythonPyprojectProvider.java
@@ -153,7 +153,9 @@ String getPipReportOutput(Path manifestDir) {
     }
 
     String pip = findPipBinary();
-    String[] cmd = {pip, "install", "--dry-run", "--ignore-installed", "--report", "-", "."};
+    String[] cmd = {
+      pip, "install", "--dry-run", "--ignore-installed", "--quiet", "--report", "-", "."
+    };
     Operations.ProcessExecOutput result =
         Operations.runProcessGetFullOutput(manifestDir, cmd, null);
     if (result.getExitCode() != 0) {