Skip to content

Bump bandit from 1.12.0 to 1.12.4 - #78

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/bandit-1.12.4
Closed

Bump bandit from 1.12.0 to 1.12.4#78
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/bandit-1.12.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor

Bumps bandit from 1.12.0 to 1.12.4.

Changelog

Sourced from bandit's changelog.

1.12.4 (27 July 2026)

Fixes

  • Properly send Connection: close header when client requests closure (#617)
  • Disallow transfer-encoding on HTTP/1.0 connections (#618)
  • Reject requests with multiple Host headers (#619)
  • Reject malformed header lines (#620)
  • Fix handling of chunk extensions (#621)

Enhancements

  • Tighten up CI against supply chain attacks (#623, thanks @​Totara-thib!)
  • Reorganize and increase coverage of HTTP/1 tests to better match RFC structure (#616)
  • Tolerate a leading newline on HTTP/1 requests (#622)
  • Send "100 Continue" interim response before reading body if client requests it (#624)

1.12.3 (25 July 2026)

Enhancements

  • Cache connection-level data between HTTP/1 keepalives (#603, thanks @​preciz!)

1.12.2 (25 July 2026)

Enhancements

  • Improve internal HTTP/2 error handling to be better about closing stream/connection
  • Coalesce header and body in to single transport send (#606, thanks @​NelsonVides!)
  • Improve compression behaviour when streaming an explicitly length delimited body (#605, thanks @​elibosley!)
  • Quiet WebSocket deserialization errors, add verbosity config lever (#610, thanks @​ericmj!)
  • Send connection: close when we're at max_requests (#613, thanks @​joshdchang!)

Fixes

1.12.1 (24 July 2026)

Fixes

  • Fix DoS issue with fragmented WebSocket frames (CVE-2026-65623, thanks @​PJUllrich!)
Commits
  • 00d532f Version bump to 1.12.4
  • 1663203 Handle clients sending an Expect: 100-continue header before sending a body...
  • e3c6595 Fixup linting error
  • c430bf5 Reapply "Pin GitHub Actions to commit SHAs (#623)"
  • a6fabe8 Revert "Pin GitHub Actions to commit SHAs (#623)"
  • e479c3b Pin GitHub Actions to commit SHAs (#623)
  • eba04e4 Tolerate a leading empty line before the request line (RFC9112§2.2) (#622)
  • c31e9e3 Fix crash on unrecognized chunk extensions (#621)
  • c24bc00 Reject header values containing CR, LF, or NUL (#620)
  • a518b29 Reject requests with multiple Host headers (#619)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code labels Aug 1, 2026
Bumps [bandit](https://github.com/mtrudel/bandit) from 1.12.0 to 1.12.4.
- [Changelog](https://github.com/mtrudel/bandit/blob/main/CHANGELOG.md)
- [Commits](mtrudel/bandit@1.12.0...1.12.4)

---
updated-dependencies:
- dependency-name: bandit
  dependency-version: 1.12.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/hex/bandit-1.12.4 branch from a84261d to 3e72ab6 Compare August 5, 2026 06:39
@dependabot @github

dependabot Bot commented on behalf of github Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

Looks like bandit is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 5, 2026
@dependabot
dependabot Bot deleted the dependabot/hex/bandit-1.12.4 branch August 5, 2026 09:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants