chore(deps): update dependency bandit to v1.8.6

[renovate]

Note

Mend has cancelled the proposed renaming of the Renovate GitHub app being renamed to mend[bot].

This notice will be removed on 2025-10-07.

---

This PR contains the following updates:

Package	Change	Age	Confidence
bandit (source, changelog)	1.7.5 -> 1.8.6

---

Release Notes

PyCQA/bandit (bandit)

v1.8.6

Compare Source

What's Changed

• Bump sigstore/cosign-installer from 3.8.2 to 3.9.0 by @​dependabot in #​1279
• Bump docker/setup-buildx-action from 3.10.0 to 3.11.1 by @​dependabot in #​1278
• added hint to FreeBSD package in doc/source/integrations.rst by @​daniel-mohr in #​1282
• Bump sigstore/cosign-installer from 3.9.0 to 3.9.1 by @​dependabot in #​1284
• Huggingface revision pinning by @​lukehinds in #​1281

New Contributors

• @​daniel-mohr made their first contribution in #​1282

Full Changelog: PyCQA/bandit@1.8.5...1.8.6

v1.8.5

Compare Source

What's Changed

• Fix the rendering of the CI/CD doc by @​ericwb in #​1274
• Fix for publish to PyPI failure by @​ericwb in #​1273

Full Changelog: PyCQA/bandit@1.8.4...1.8.5

v1.8.3

Compare Source

What's Changed

• Bump docker/build-push-action from 6.10.0 to 6.11.0 by @​dependabot in #​1220
• Bump docker/build-push-action from 6.11.0 to 6.12.0 by @​dependabot in #​1221
• Bump docker/build-push-action from 6.12.0 to 6.13.0 by @​dependabot in #​1222
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in #​1229
• Update bug template to include latest released versions by @​ericwb in #​1218
• Add markupsafe.Markup XSS plugin by @​Daverball in #​1225
• Warn not error on an nonexistant test given by @​ericwb in #​1230
• Bump sigstore/cosign-installer from 3.7.0 to 3.8.0 by @​dependabot in #​1233
• Bump docker/setup-buildx-action from 3.8.0 to 3.9.0 by @​dependabot in #​1234
• B107: Skip None values in hardcoded password detection by @​lukehinds in #​1232
• Pytorch fix by @​lukehinds in #​1231

New Contributors

• @​Daverball made their first contribution in #​1225

Full Changelog: PyCQA/bandit@1.8.2...1.8.3

v1.8.2

Compare Source

What's Changed

• Revert "Start testing with 3.14 alphas" by @​ericwb in #​1217

Full Changelog: PyCQA/bandit@1.8.1...1.8.2

v1.8.1

Compare Source

What's Changed

• Bump docker/build-push-action from 6.9.0 to 6.10.0 by @​dependabot in #​1209
• Update the bug template with latest bandit version by @​ericwb in #​1208
• Add Mercedes-Benz to sponsor list by @​ericwb in #​1210
• Bump docker/setup-buildx-action from 3.7.1 to 3.8.0 by @​dependabot in #​1211
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in #​1213
• Start testing with 3.14 alphas by @​ericwb in #​1189
• Remove lxml (B320 & B410) from blacklist by @​djbrown in #​1212
• Clarify "getting started" docs by @​Flimm in #​963

New Contributors

• @​djbrown made their first contribution in #​1212
• @​Flimm made their first contribution in #​963

Full Changelog: PyCQA/bandit@1.8.0...1.8.1

v1.8.0

Compare Source

What's Changed

• Bump docker/build-push-action from 6.7.0 to 6.9.0 by @​dependabot in #​1178
• Rename doc file to match proper bandit ID by @​ericwb in #​1183
• Removal of Python 3.8 support by @​ericwb in #​1174
• Add more insecure cryptography cipher algorithms by @​ericwb in #​1185
• Bump docker/setup-buildx-action from 3.6.1 to 3.7.1 by @​dependabot in #​1186
• Bump sigstore/cosign-installer from 3.6.0 to 3.7.0 by @​dependabot in #​1187
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in #​1162
• No need to check httpx client without timeout defined by @​ericwb in #​1177
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in #​1191
• Mark Python 3.13 as officially supported by @​ericwb in #​1192
• Update project urls with added links by @​ericwb in #​1193
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in #​1196
• Add a JSON to seek funding from the FLOSS/fund by @​ericwb in #​1194
• Remove Sentry as a sponsor by @​ericwb in #​1198
• Remove more leftover OpenStack references by @​ericwb in #​1195

Full Changelog: PyCQA/bandit@1.7.10...1.8.0

v1.7.10

Compare Source

What's Changed

• Bump docker/build-push-action from 5.4.0 to 6.0.0 by @​dependabot in #​1147
• Suggested small refactors in assignments by @​ericwb in #​1150
• Performance improvement in blacklist function by @​ericwb in #​1148
• Add test for usage of FTP_TLS by @​ericwb in #​1149
• New check: B113: TrojanSource - Bidirectional control characters by @​Lucas-C in #​757
• Bump docker/build-push-action from 6.0.0 to 6.1.0 by @​dependabot in #​1152
• feat(plugins): add support for httpx in B113 by @​mkniewallner in #​1060
• Nit: remove unused variable by @​ericwb in #​1153
• Add recent releases to version choice in bug report by @​ericwb in #​1151
• Bump docker/build-push-action from 6.1.0 to 6.2.0 by @​dependabot in #​1155
• Bump docker/build-push-action from 6.2.0 to 6.3.0 by @​dependabot in #​1157
• Bump docker/setup-buildx-action from 3.3.0 to 3.4.0 by @​dependabot in #​1156
• Bump docker/setup-buildx-action from 3.4.0 to 3.5.0 by @​dependabot in #​1158
• Bump docker/login-action from 3.2.0 to 3.3.0 by @​dependabot in #​1159
• Bump docker/build-push-action from 6.3.0 to 6.5.0 by @​dependabot in #​1160
• Bump docker/setup-buildx-action from 3.5.0 to 3.6.1 by @​dependabot in #​1163
• Bump docker/build-push-action from 6.5.0 to 6.6.1 by @​dependabot in #​1166
• Bump sigstore/cosign-installer from 3.5.0 to 3.6.0 by @​dependabot in #​1165
• Bump docker/build-push-action from 6.6.1 to 6.7.0 by @​dependabot in #​1168
• Use consistent file naming of docs by @​ericwb in #​1170
• Pytorch Load / Save Plugin by @​lukehinds in #​1114

New Contributors

• @​Lucas-C made their first contribution in #​757

Full Changelog: PyCQA/bandit@1.7.9...1.7.10

v1.7.9

Compare Source

What's Changed

• Bump docker/build-push-action from 5.1.0 to 5.2.0 by @​dependabot in #​1117
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in #​1119
• New logo for Bandit based on raccoon by @​ericwb in #​1121
• Start testing on Python 3.13 by @​ericwb in #​1122
• Bump docker/build-push-action from 5.2.0 to 5.3.0 by @​dependabot in #​1123
• Bump docker/setup-buildx-action from 3.1.0 to 3.2.0 by @​dependabot in #​1124
• Bump docker/login-action from 3.0.0 to 3.1.0 by @​dependabot in #​1125
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in #​1126
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in #​1127
• Bump docker/setup-buildx-action from 3.2.0 to 3.3.0 by @​dependabot in #​1130
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in #​1131
• Bump sigstore/cosign-installer from 3.4.0 to 3.5.0 by @​dependabot in #​1132
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in #​1133
• Updates banner logo so it renders well in dark mode by @​ericwb in #​1134
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in #​1135
• Add a sponsor section to README by @​ericwb in #​1137
• Ensure sarif extra is included as part of doc build by @​ericwb in #​1139
• Bump docker/login-action from 3.1.0 to 3.2.0 by @​dependabot in #​1142
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in #​1143
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in #​1145
• Guard against empty call argument list by @​ericwb in #​1146
• Bump docker/build-push-action from 5.3.0 to 5.4.0 by @​dependabot in #​1144
• Support configfile in .bandit file by @​bersbersbers in #​1052

New Contributors

• @​pre-commit-ci made their first contribution in #​1119
• @​bersbersbers made their first contribution in #​1052

Full Changelog: PyCQA/bandit@1.7.8...1.7.9

v1.7.8

Compare Source

What's Changed

• Incorrect tag naming in readme by @​lukehinds in #​1105
• Utilize PyPI's trusted publishing by @​ericwb in #​1107
• Bump sigstore/cosign-installer from 3.3.0 to 3.4.0 by @​dependabot in #​1109
• Add 1.7.7 to versions of bug template by @​ericwb in #​1110
• Use datetime to avoid updating copyright year by @​ericwb in #​1112
• filter data is safe for tarfile extractall by @​etienneschalk in #​1111
• Bump docker/setup-buildx-action from 3.0.0 to 3.1.0 by @​dependabot in #​1115
• [B605] Add functions that are vulnerable to shell injection. by @​shihai1991 in #​1116
• Add a SARIF output formatter by @​ericwb in #​1113

New Contributors

• @​etienneschalk made their first contribution in #​1111
• @​shihai1991 made their first contribution in #​1116

Full Changelog: PyCQA/bandit@1.7.7...1.7.8

v1.7.7

Compare Source

What's Changed

• Add the new release to bandit versions of bug template by @​ericwb in #​1075
• Bump actions/setup-python from 4 to 5 by @​dependabot in #​1076
• Handle variant in how policy is passed in paramiko by @​ericwb in #​1078
• Flag str.replace as possible sql injection by @​costaparas in #​1044
• defusedxml: Show correct module name by @​kajinamit in #​1081
• Add tidelift to the sponsor funding list by @​ericwb in #​1089
• Create a security policy by @​ericwb in #​1091
• Fix up issues found running Bandit on itself by @​ericwb in #​1093
• Add random.randbytes to blacklist calls by @​ericwb in #​1096
• Prepend ./ for files specified as CLI args by @​ericwb in #​1094
• Rework GitPython dependency to be an extra for bandit-baseline by @​ericwb in #​1099
• Bump actions/dependency-review-action from 3 to 4 by @​dependabot in #​1101
• Introduce Official Bandit Images by @​lukehinds in #​1088
• Remove markdown formatting in reStructuredText formatted README by @​ericwb in #​1103
• Downsize the org:repo name by @​lukehinds in #​1104

New Contributors

• @​kajinamit made their first contribution in #​1081

Full Changelog: PyCQA/bandit@1.7.6...1.7.7

v1.7.6

Compare Source

What's Changed

• Update bug report to include version 1.7.5 by @​ericwb in #​993
• Render Python 3.10 in drop down correctly by @​ericwb in #​997
• Remove checks for Python2 urllib by @​ericwb in #​999
• Improper detection of non-requests module by @​ericwb in #​1011
• xmlrpclib replaced with xmlrpc in Python3 by @​ericwb in #​1012
• language and linting updates by @​marksmayo in #​1015
• Adds check for crypt module usage as weak hash by @​ericwb in #​1018
• Switch to tox 4 by @​mportesdev in #​1020
• Skip unnecessary pip install commands in the pythonpackage.yml workflow by @​mportesdev in #​1021
• Update versions of used GitHub Actions by @​mportesdev in #​1024
• Update pre-commit hooks by @​mportesdev in #​1026
• Add random.Random to B311 checks by @​shiftinv in #​940
• Add a copy button to all code snippets in docs by @​ericwb in #​1030
• Replace pbr in favor of importlib by @​ericwb in #​1016
• Switch from open collective to PSF by @​ericwb in #​1031
• Make pre-commit run Bandit hook using a single process by @​Klavionik in #​1029
• Remove support for Python 3.7 due to end-of-life by @​ericwb in #​1034
• Update asserts.py documentation by @​deronnax in #​1036
• Simplify wrap_file_object by @​mportesdev in #​1037
• django_rawsql_used: support keyword arguments used in RawSQL by @​kevinmarsh in #​765
• Avoid gitpyhon CVE-2022-24439 by @​carlosduelo in #​1048
• Update blacklist call documentation by @​costaparas in #​1045
• Support ignoring blacklists by name by @​costaparas in #​1046
• Fix dependabot to update github actions by @​ericwb in #​1057
• Bump actions/checkout from 3 to 4 by @​dependabot in #​1058
• Fix for ReadtheDocs build by @​ericwb in #​1061
• fix(plugins/B507): also detect class instances by @​mkniewallner in #​1064
• Use mirror repository for black pre-commit hook by @​mportesdev in #​1070
• Add official support of Python 3.12 by @​ericwb in #​1068
• Fix crash on pyproject.toml without bandit config by @​javajawa in #​1073
• refactor: remove importlib-metadata fallback by @​mkniewallner in #​1066
• Fixes for sphinx build by @​ericwb in #​1063

New Contributors

• @​marksmayo made their first contribution in #​1015
• @​shiftinv made their first contribution in #​940
• @​Klavionik made their first contribution in #​1029
• @​deronnax made their first contribution in #​1036
• @​kevinmarsh made their first contribution in #​765
• @​carlosduelo made their first contribution in #​1048
• @​costaparas made their first contribution in #​1045
• @​dependabot made their first contribution in #​1058
• @​javajawa made their first contribution in #​1073

Full Changelog: PyCQA/bandit@1.7.5...1.7.6

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.