local-it/mitgliederverwaltung
local-it/mitgliederverwaltung
2
3
Fork 0
Code Issues 58 Pull requests 7 Projects 1 Releases 6 Packages 1 Activity Actions

chore(deps): update dependency bandit to v1.12.5 [security] - autoclosed #576

Closed
renovate wants to merge 1 commit from renovate/hex-bandit-vulnerability into main
pull from: renovate/hex-bandit-vulnerability
merge into: local-it:main
Conversation 0 Commits 1 Files changed 1 +4 -4
renovate commented 2026-10-08 14:23:12 +02:00
Collaborator
Copy link

This PR contains the following updates:

Package Type Update Change
bandit (source) prod patch 1.12.0 → 1.12.5

Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

CVE-2026-65623 / EEF-CVE-2026-65623 / GHSA-vg8x-66vg-5pxh

More information

Details

Summary

Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly.

The size guard 'Elixir.Bandit.WebSocket.Connection':oversize_message?/2 called from handle_frame/3 in lib/bandit/websocket/connection.ex appends each non-final continuation frame to a left-nested iolist and then re-measures the entire accumulated buffer with IO.iodata_length/1 on every frame. Because the buffer grows by one element per frame and is fully re-traversed each time, reassembly work is quadratic (O(n^2)) in the number of continuation frames.

The max_fragmented_message_size limit (default 8 MB) bounds total bytes but not frame count, and each frame can carry as little as one payload byte, so an attacker can send millions of tiny continuation frames using modest bandwidth to pin a CPU core for minutes to hours. Many concurrent connections can starve the whole server of CPU, denying service to legitimate users. The WebSocket read timeout does not help, because it is an idle timeout evaluated between reads and cannot preempt the synchronous reassembly work spent inside a single callback.

This issue affects bandit: from 1.11.0 before 1.12.1.

Configurations

This vulnerability only affects applications that serve WebSocket endpoints through Bandit (including Phoenix applications that use Bandit as the HTTP adapter). Applications that do not upgrade any connections to WebSocket are not affected.

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV.

HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

CVE-2026-74836 / EEF-CVE-2026-74836 / GHSA-xj8g-532w-jv94

More information

Details

Summary

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level send window (default 65,535 bytes, shared across all streams on the connection), Bandit.HTTP2.Connection queues the remaining bytes and a reply closure in pending_sends and the stream process blocks forever inside a synchronous call to the connection process. Nothing bounds that wait and nothing purges the queue: a client RST_STREAM for the blocked stream is delivered to its mailbox but never read while it is stuck inside the call, so cancelling frees nothing, and periodic PING frames keep the transport-level read timeout from ever firing. The equivalent block on the stream-level send window is already bounded at 15 seconds; the connection-level path had no such bound.

Each stalled stream pins its process, Plug state, and any resource the Plug holds across the blocked write, such as a pooled upstream connection in a reverse-proxy Plug. The attacker chooses any endpoint whose response exceeds the connection window (common for most non-trivial payloads), grants a generous stream-level window so only the connection window limits it, and keeps the connection alive with periodic PINGs; the primitive is repeatable across streams and connections at the cost of one idle socket each.

This issue affects bandit: from 0.3.4 before 1.12.5.

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV.

HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

CVE-2026-75484 / EEF-CVE-2026-75484 / GHSA-x3gh-xhj4-3vq8

More information

Details

Summary

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.read_headers/1 validates pseudo-header placement and uniqueness, header-name casing, connection-specific headers, the te value, and content-length, but never checks field values. Because HPACK carries arbitrary octets, a HEADERS block whose field values contain \r, \n, or \0 decodes without error and the values land in conn.req_headers unchanged. The HTTP/1 path already rejects the same octets; HTTP/2 did not.

Bandit itself is not a sink for the injected bytes: its own logging uses fixed strings or inspect, and HTTP/2 response headers are HPACK-encoded and separately rejected by Plug's put_resp_header, so response splitting is not reachable through this path. The risk is entirely in how a downstream application consumes header values, such as appending one verbatim to a plain-text log or concatenating it into an upstream request. A related gap bundled in the same fix: only :method, :scheme, and :path were checked for at most one occurrence; a duplicate :authority pseudo-header was accepted, with the first instance silently winning as conn.host while a conflicting value remained visible to the application.

This issue affects bandit: from 1.4.0 before 1.12.5.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV.

Release Notes

mtrudel/bandit (bandit)

v1.12.5

Compare Source

Changes
  • Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532w-jv94) (#​671)
  • Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings (#​665)
  • Treat proxy-connection as a connection-specific header in HTTP/2 (#​632)
  • Return FRAME_SIZE_ERROR for HEADERS/DATA frames too short for their flags (#​652)
  • Treat abortive-close posix reasons as client closures in logging (#​663)
Fixes
  • Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) (#​670)
  • Use PROTOCOL_ERROR for a zero WINDOW_UPDATE increment (#​656)
  • Reject send_file ranges past EOF instead of emitting a negative Content-Length (#​653)
  • Reject compressed WebSocket control frames regardless of the fin bit (#​651)
  • Enforce the RFC9112 chunk-size grammar and reject repeated transfer-encoding (#​631)
  • Fix typos (#​627)
  • Fix non-deterministic compile-time code (#​646)
Enhancements
  • Lazily precompile the invalid-field-value match pattern (#​662)
  • Add tests for untested configuration options (#​659)
  • Match the weak-etag prefix W/ explicitly (#​657)
  • Do not duplicate an existing vary: accept-encoding header (#​658)
  • Honor the close/keep-alive token inside a comma-separated Connection header (#​655)
  • Initialize the per-stream receive window from the advertised initial_window_size (#​654)
  • Keep track of body_length to avoid list iterations (#​645)
  • Avoid per-header length/1 and option lookups in do_read_headers! (#​614) (#​626)

v1.12.4

Compare Source

Fixes
  • Properly send Connection: close header when client requests closure (#​617)
  • Disallow transfer-encoding on HTTP/1.0 connections (#​618)
  • Reject requests with multiple Host headers (#​619)
  • Reject malformed header lines (#​620)
  • Fix handling of chunk extensions (#​621)
Enhancements
  • Tighten up CI against supply chain attacks (#​623, thanks @​Totara-thib!)
  • Reorganize and increase coverage of HTTP/1 tests to better match RFC structure (#​616)
  • Tolerate a leading newline on HTTP/1 requests (#​622)
  • Send "100 Continue" interim response before reading body if client requests it (#​624)

v1.12.3

Compare Source

Enhancements
  • Cache connection-level data between HTTP/1 keepalives (#​603, thanks @​preciz!)

v1.12.2

Compare Source

Enhancements
  • Improve internal HTTP/2 error handling to be better about closing stream/connection
  • Coalesce header and body in to single transport send (#​606, thanks @​NelsonVides!)
  • Improve compression behaviour when streaming an explicitly length delimited body (#​605, thanks @​elibosley!)
  • Quiet WebSocket deserialization errors, add verbosity config lever (#​610, thanks @​ericmj!)
  • Send connection: close when we're at max_requests (#​613, thanks @​joshdchang!)
Fixes

v1.12.1

Compare Source

Fixes
  • Fix DoS issue with fragmented WebSocket frames (CVE-2026-65623, thanks @​PJUllrich!)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [bandit](https://hex.pm/packages/bandit) ([source](https://github.com/mtrudel/bandit)) | prod | patch | `1.12.0` → `1.12.5` | --- ### Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit [CVE-2026-65623](https://nvd.nist.gov/vuln/detail/CVE-2026-65623) / EEF-CVE-2026-65623 / [GHSA-vg8x-66vg-5pxh](https://github.com/advisories/GHSA-vg8x-66vg-5pxh) <details> <summary>More information</summary> #### Details ##### Summary Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The size guard 'Elixir.Bandit.WebSocket.Connection':oversize\_message?/2 called from handle\_frame/3 in lib/bandit/websocket/connection.ex appends each non-final continuation frame to a left-nested iolist and then re-measures the entire accumulated buffer with IO.iodata\_length/1 on every frame. Because the buffer grows by one element per frame and is fully re-traversed each time, reassembly work is quadratic (O(n^2)) in the number of continuation frames. The max\_fragmented\_message\_size limit (default 8 MB) bounds total bytes but not frame count, and each frame can carry as little as one payload byte, so an attacker can send millions of tiny continuation frames using modest bandwidth to pin a CPU core for minutes to hours. Many concurrent connections can starve the whole server of CPU, denying service to legitimate users. The WebSocket read timeout does not help, because it is an idle timeout evaluated between reads and cannot preempt the synchronous reassembly work spent inside a single callback. This issue affects bandit: from 1.11.0 before 1.12.1. ##### Configurations This vulnerability only affects applications that serve WebSocket endpoints through Bandit (including Phoenix applications that use Bandit as the HTTP adapter). Applications that do not upgrade any connections to WebSocket are not affected. #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/mtrudel/bandit/security/advisories/GHSA-vg8x-66vg-5pxh](https://github.com/mtrudel/bandit/security/advisories/GHSA-vg8x-66vg-5pxh) - [https://cna.erlef.org/cves/CVE-2026-65623.html](https://cna.erlef.org/cves/CVE-2026-65623.html) - [https://github.com/mtrudel/bandit/commit/418ef7e906192a230ddba112f7a669c87b6b0e3a](https://github.com/mtrudel/bandit/commit/418ef7e906192a230ddba112f7a669c87b6b0e3a) - [https://hex.pm/packages/bandit](https://hex.pm/packages/bandit) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-65623). </details> --- ### HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit [CVE-2026-74836](https://nvd.nist.gov/vuln/detail/CVE-2026-74836) / EEF-CVE-2026-74836 / [GHSA-xj8g-532w-jv94](https://github.com/advisories/GHSA-xj8g-532w-jv94) <details> <summary>More information</summary> #### Details ##### Summary Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level send window (default 65,535 bytes, shared across all streams on the connection), `Bandit.HTTP2.Connection` queues the remaining bytes and a reply closure in `pending_sends` and the stream process blocks forever inside a synchronous call to the connection process. Nothing bounds that wait and nothing purges the queue: a client `RST_STREAM` for the blocked stream is delivered to its mailbox but never read while it is stuck inside the call, so cancelling frees nothing, and periodic PING frames keep the transport-level read timeout from ever firing. The equivalent block on the stream-level send window is already bounded at 15 seconds; the connection-level path had no such bound. Each stalled stream pins its process, Plug state, and any resource the Plug holds across the blocked write, such as a pooled upstream connection in a reverse-proxy Plug. The attacker chooses any endpoint whose response exceeds the connection window (common for most non-trivial payloads), grants a generous stream-level window so only the connection window limits it, and keeps the connection alive with periodic PINGs; the primitive is repeatable across streams and connections at the cost of one idle socket each. This issue affects bandit: from 0.3.4 before 1.12.5. #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/mtrudel/bandit/security/advisories/GHSA-xj8g-532w-jv94](https://github.com/mtrudel/bandit/security/advisories/GHSA-xj8g-532w-jv94) - [https://cna.erlef.org/cves/CVE-2026-74836.html](https://cna.erlef.org/cves/CVE-2026-74836.html) - [https://github.com/mtrudel/bandit/commit/f6914aad14bb1365dd6f306aa592cfb0819bed3e](https://github.com/mtrudel/bandit/commit/f6914aad14bb1365dd6f306aa592cfb0819bed3e) - [https://hex.pm/packages/bandit](https://hex.pm/packages/bandit) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-74836). </details> --- ### HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit [CVE-2026-75484](https://nvd.nist.gov/vuln/detail/CVE-2026-75484) / EEF-CVE-2026-75484 / [GHSA-x3gh-xhj4-3vq8](https://github.com/advisories/GHSA-x3gh-xhj4-3vq8) <details> <summary>More information</summary> #### Details ##### Summary Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. `Bandit.HTTP2.Stream.read_headers/1` validates pseudo-header placement and uniqueness, header-name casing, connection-specific headers, the `te` value, and `content-length`, but never checks field *values*. Because HPACK carries arbitrary octets, a HEADERS block whose field values contain `\r`, `\n`, or `\0` decodes without error and the values land in `conn.req_headers` unchanged. The HTTP/1 path already rejects the same octets; HTTP/2 did not. Bandit itself is not a sink for the injected bytes: its own logging uses fixed strings or `inspect`, and HTTP/2 response headers are HPACK-encoded and separately rejected by Plug's `put_resp_header`, so response splitting is not reachable through this path. The risk is entirely in how a downstream application consumes header values, such as appending one verbatim to a plain-text log or concatenating it into an upstream request. A related gap bundled in the same fix: only `:method`, `:scheme`, and `:path` were checked for at most one occurrence; a duplicate `:authority` pseudo-header was accepted, with the first instance silently winning as `conn.host` while a conflicting value remained visible to the application. This issue affects bandit: from 1.4.0 before 1.12.5. #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/mtrudel/bandit/security/advisories/GHSA-x3gh-xhj4-3vq8](https://github.com/mtrudel/bandit/security/advisories/GHSA-x3gh-xhj4-3vq8) - [https://cna.erlef.org/cves/CVE-2026-75484.html](https://cna.erlef.org/cves/CVE-2026-75484.html) - [https://github.com/mtrudel/bandit/commit/d38cf046c9a3cae4d0f88001c2ceb4143f86366b](https://github.com/mtrudel/bandit/commit/d38cf046c9a3cae4d0f88001c2ceb4143f86366b) - [https://hex.pm/packages/bandit](https://hex.pm/packages/bandit) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-75484). </details> --- ### Release Notes <details> <summary>mtrudel/bandit (bandit)</summary> ### [`v1.12.5`](https://github.com/mtrudel/bandit/blob/HEAD/CHANGELOG.md#1125-20-Aug-2026) [Compare Source](https://github.com/mtrudel/bandit/compare/1.12.4...1.12.5) ##### Changes - Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532w-jv94) ([#&#8203;671](https://github.com/mtrudel/bandit/issues/671)) - Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings ([#&#8203;665](https://github.com/mtrudel/bandit/issues/665)) - Treat proxy-connection as a connection-specific header in HTTP/2 ([#&#8203;632](https://github.com/mtrudel/bandit/issues/632)) - Return FRAME\_SIZE\_ERROR for HEADERS/DATA frames too short for their flags ([#&#8203;652](https://github.com/mtrudel/bandit/issues/652)) - Treat abortive-close posix reasons as client closures in logging ([#&#8203;663](https://github.com/mtrudel/bandit/issues/663)) ##### Fixes - Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) ([#&#8203;670](https://github.com/mtrudel/bandit/issues/670)) - Use PROTOCOL\_ERROR for a zero WINDOW\_UPDATE increment ([#&#8203;656](https://github.com/mtrudel/bandit/issues/656)) - Reject send\_file ranges past EOF instead of emitting a negative Content-Length ([#&#8203;653](https://github.com/mtrudel/bandit/issues/653)) - Reject compressed WebSocket control frames regardless of the fin bit ([#&#8203;651](https://github.com/mtrudel/bandit/issues/651)) - Enforce the RFC9112 chunk-size grammar and reject repeated transfer-encoding ([#&#8203;631](https://github.com/mtrudel/bandit/issues/631)) - Fix typos ([#&#8203;627](https://github.com/mtrudel/bandit/issues/627)) - Fix non-deterministic compile-time code ([#&#8203;646](https://github.com/mtrudel/bandit/issues/646)) ##### Enhancements - Lazily precompile the invalid-field-value match pattern ([#&#8203;662](https://github.com/mtrudel/bandit/issues/662)) - Add tests for untested configuration options ([#&#8203;659](https://github.com/mtrudel/bandit/issues/659)) - Match the weak-etag prefix W/ explicitly ([#&#8203;657](https://github.com/mtrudel/bandit/issues/657)) - Do not duplicate an existing vary: accept-encoding header ([#&#8203;658](https://github.com/mtrudel/bandit/issues/658)) - Honor the close/keep-alive token inside a comma-separated Connection header ([#&#8203;655](https://github.com/mtrudel/bandit/issues/655)) - Initialize the per-stream receive window from the advertised initial\_window\_size ([#&#8203;654](https://github.com/mtrudel/bandit/issues/654)) - Keep track of body\_length to avoid list iterations ([#&#8203;645](https://github.com/mtrudel/bandit/issues/645)) - Avoid per-header length/1 and option lookups in do\_read\_headers! ([#&#8203;614](https://github.com/mtrudel/bandit/issues/614)) ([#&#8203;626](https://github.com/mtrudel/bandit/issues/626)) ### [`v1.12.4`](https://github.com/mtrudel/bandit/blob/HEAD/CHANGELOG.md#1124-27-July-2026) [Compare Source](https://github.com/mtrudel/bandit/compare/1.12.3...1.12.4) ##### Fixes - Properly send Connection: close header when client requests closure ([#&#8203;617](https://github.com/mtrudel/bandit/issues/617)) - Disallow transfer-encoding on HTTP/1.0 connections ([#&#8203;618](https://github.com/mtrudel/bandit/issues/618)) - Reject requests with multiple Host headers ([#&#8203;619](https://github.com/mtrudel/bandit/issues/619)) - Reject malformed header lines ([#&#8203;620](https://github.com/mtrudel/bandit/issues/620)) - Fix handling of chunk extensions ([#&#8203;621](https://github.com/mtrudel/bandit/issues/621)) ##### Enhancements - Tighten up CI against supply chain attacks ([#&#8203;623](https://github.com/mtrudel/bandit/issues/623), thanks [@&#8203;Totara-thib](https://github.com/Totara-thib)!) - Reorganize and increase coverage of HTTP/1 tests to better match RFC structure ([#&#8203;616](https://github.com/mtrudel/bandit/issues/616)) - Tolerate a leading newline on HTTP/1 requests ([#&#8203;622](https://github.com/mtrudel/bandit/issues/622)) - Send "100 Continue" interim response before reading body if client requests it ([#&#8203;624](https://github.com/mtrudel/bandit/issues/624)) ### [`v1.12.3`](https://github.com/mtrudel/bandit/blob/HEAD/CHANGELOG.md#1123-25-July-2026) [Compare Source](https://github.com/mtrudel/bandit/compare/1.12.2...1.12.3) ##### Enhancements - Cache connection-level data between HTTP/1 keepalives ([#&#8203;603](https://github.com/mtrudel/bandit/issues/603), thanks [@&#8203;preciz](https://github.com/preciz)!) ### [`v1.12.2`](https://github.com/mtrudel/bandit/blob/HEAD/CHANGELOG.md#1122-25-July-2026) [Compare Source](https://github.com/mtrudel/bandit/compare/1.12.1...1.12.2) ##### Enhancements - Improve internal HTTP/2 error handling to be better about closing stream/connection - Coalesce header and body in to single transport send ([#&#8203;606](https://github.com/mtrudel/bandit/issues/606), thanks [@&#8203;NelsonVides](https://github.com/NelsonVides)!) - Improve compression behaviour when streaming an explicitly length delimited body ([#&#8203;605](https://github.com/mtrudel/bandit/issues/605), thanks [@&#8203;elibosley](https://github.com/elibosley)!) - Quiet WebSocket deserialization errors, add verbosity config lever ([#&#8203;610](https://github.com/mtrudel/bandit/issues/610), thanks [@&#8203;ericmj](https://github.com/ericmj)!) - Send connection: close when we're at max\_requests ([#&#8203;613](https://github.com/mtrudel/bandit/issues/613), thanks [@&#8203;joshdchang](https://github.com/joshdchang)!) ##### Fixes - Fix bogus check for unmasked WebSocket frames (<https://github.com/mtrudel/bandit/security/advisories/GHSA-rhh8-5xw9-c3gm>, thanks [@&#8203;lukaszsamson](https://github.com/lukaszsamson)!) - Enforce max\_header\_list\_size if overridden (<https://github.com/mtrudel/bandit/security/advisories/GHSA-9q5m-g6v3-6772>, thanks [@&#8203;lukaszsamson](https://github.com/lukaszsamson)!) ### [`v1.12.1`](https://github.com/mtrudel/bandit/blob/HEAD/CHANGELOG.md#1121-24-July-2026) [Compare Source](https://github.com/mtrudel/bandit/compare/1.12.0...1.12.1) ##### Fixes - Fix DoS issue with fragmented WebSocket frames (CVE-2026-65623, thanks [@&#8203;PJUllrich](https://github.com/PJUllrich)!) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE2NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJhdXRvbWF0ZWQiLCJkZXBlbmRlbmNpZXMiLCJyZW5vdmF0ZSIsInNlY3VyaXR5Il19-->
chore(deps): update dependency bandit to v1.12.5 [security]
All checks were successful
continuous-integration/drone/push Build is passing
Details
b90dd5afd6
renovate force-pushed renovate/hex-bandit-vulnerability from b90dd5afd6
All checks were successful
continuous-integration/drone/push Build is passing
Details
to 0b895e3adc
All checks were successful
continuous-integration/drone/push Build is passing
Details
2026-10-08 21:23:35 +02:00 Compare
renovate changed title from chore(deps): update dependency bandit to v1.12.5 [security] to chore(deps): update dependency bandit to v1.12.5 [security] - autoclosed 2026-10-12 12:14:41 +02:00
renovate closed this pull request 2026-10-12 12:14:41 +02:00
Some checks are pending
continuous-integration/drone/push Build is passing
Details
continuous-integration/drone/promote/production
Required

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
high priority

   
invalid
Something is wrong

  
L
5 h

  
low priority

   
M
3 h

  
medium priority

   
needs refinement

   
optional

   
question
More information is needed

  
S
1 h

  
security

   
technical improvement

   
UX Improvement

   
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
high priority
invalid
L
low priority
M
medium priority
needs refinement
optional
question
S
security
technical improvement
UX Improvement
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
local-it/mitgliederverwaltung!576
No description provided.