Bump bandit from 1.11.1 to 1.12.4

[dependabot]

Bumps bandit from 1.11.1 to 1.12.4.

Changelog

Sourced from bandit's changelog.

1.12.4 (27 July 2026)

Fixes

• Properly send Connection: close header when client requests closure (#617)
• Disallow transfer-encoding on HTTP/1.0 connections (#618)
• Reject requests with multiple Host headers (#619)
• Reject malformed header lines (#620)
• Fix handling of chunk extensions (#621)

Enhancements

• Tighten up CI against supply chain attacks (#623, thanks @​Totara-thib!)
• Reorganize and increase coverage of HTTP/1 tests to better match RFC structure (#616)
• Tolerate a leading newline on HTTP/1 requests (#622)
• Send "100 Continue" interim response before reading body if client requests it (#624)

1.12.3 (25 July 2026)

Enhancements

• Cache connection-level data between HTTP/1 keepalives (#603, thanks @​preciz!)

1.12.2 (25 July 2026)

Enhancements

• Improve internal HTTP/2 error handling to be better about closing stream/connection
• Coalesce header and body in to single transport send (#606, thanks @​NelsonVides!)
• Improve compression behaviour when streaming an explicitly length delimited body (#605, thanks @​elibosley!)
• Quiet WebSocket deserialization erorrs, add verbosity config lever (#610, thanks @​ericmj!)
• Send connection: close when we're at max_requests (#613, thanks @​joshdchang!)

Fixes

• Fix bogus check for unmasked WebSocket frames (GHSA-rhh8-5xw9-c3gm, thanks @​lukaszsamson!)
• Enforce max_header_list_size if overridden (GHSA-9q5m-g6v3-6772, thanks @​lukaszsamson!)

1.12.1 (24 July 2026)

Fixes

• Fix DoS issue with fragmented WebSocket frames (CVE-2026-65623, thanks @​PJUllrich!)

1.12.0 (5 June 2026)

... (truncated)

Commits

• 00d532f Version bump to 1.12.4
• 1663203 Handle clients sending an Expect: 100-continue header before sending a body...
• e3c6595 Fixup linting error
• c430bf5 Reapply "Pin GitHub Actions to commit SHAs (#623)"
• a6fabe8 Revert "Pin GitHub Actions to commit SHAs (#623)"
• e479c3b Pin GitHub Actions to commit SHAs (#623)
• eba04e4 Tolerate a leading empty line before the request line (RFC9112§2.2) (#622)
• c31e9e3 Fix crash on unrecognized chunk extensions (#621)
• c24bc00 Reject header values containing CR, LF, or NUL (#620)
• a518b29 Reject requests with multiple Host headers (#619)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)