dependencies: bump the python-development group across 1 directory with 2 updates

[dependabot]

Bumps the python-development group with 2 updates in the / directory: bandit and pip-tools.

Updates bandit from 1.8.0 to 1.9.4

Release notes

Sourced from bandit's releases.

1.9.4

What's Changed

• chore: fixed some typos in comments by @​jakob1379 in PyCQA/bandit#1351
• Bump docker/login-action from 3.6.0 to 3.7.0 by @​dependabot[bot] in PyCQA/bandit#1353
• Bump docker/build-push-action from 6.18.0 to 6.19.2 by @​dependabot[bot] in PyCQA/bandit#1357
• Fix B613 crash when reading from stdin by @​worksbyfriday in PyCQA/bandit#1361
• Include filename in nosec 'no failed test' warning by @​worksbyfriday in PyCQA/bandit#1363
• Fix B615 false positive when revision is set via variable by @​worksbyfriday in PyCQA/bandit#1358
• Lower version guard in check_ast_node to Python 3.12 by @​rcgray in PyCQA/bandit#1355
• Fix B106 reporting wrong line number on multiline function calls by @​worksbyfriday in PyCQA/bandit#1360

New Contributors

• @​jakob1379 made their first contribution in PyCQA/bandit#1351
• @​worksbyfriday made their first contribution in PyCQA/bandit#1361
• @​rcgray made their first contribution in PyCQA/bandit#1355

Full Changelog: PyCQA/bandit@1.9.3...1.9.4

1.9.3

What's Changed

• Bump actions/checkout from 5 to 6 by @​dependabot[bot] in PyCQA/bandit#1334
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in PyCQA/bandit#1335
• Fix B608 to detect VALUES( without space by @​kfess in PyCQA/bandit#1337
• Add check for hardcoded passwords in dicts. by @​alanverresen in PyCQA/bandit#1338
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in PyCQA/bandit#1341
• Update tox tests for Python 3.10 by @​willschlitzer in PyCQA/bandit#1346
• Bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by @​dependabot[bot] in PyCQA/bandit#1347
• Limit B614 to torch.load deserializers by @​dibussoc in PyCQA/bandit#1348

New Contributors

• @​kfess made their first contribution in PyCQA/bandit#1337
• @​alanverresen made their first contribution in PyCQA/bandit#1338
• @​willschlitzer made their first contribution in PyCQA/bandit#1346
• @​dibussoc made their first contribution in PyCQA/bandit#1348

Full Changelog: PyCQA/bandit@1.9.2...1.9.3

1.9.2

What's Changed

• Argparse Python 3.14 enhancements by @​ericwb in PyCQA/bandit#1331
• Check whether Constant value is str by @​ericwb in PyCQA/bandit#1333

Full Changelog: PyCQA/bandit@1.9.1...1.9.2

1.9.1

What's Changed

• More Python version related fixes by @​ericwb in PyCQA/bandit#1327

... (truncated)

Commits

• 92ae8b8 Fix B106 reporting wrong line number on multiline function calls (#1360)
• c8c8a55 Lower version guard in check_ast_node to Python 3.12 (#1355)
• 8f2f928 Fix B615 false positive when revision is set via variable (#1358)
• e27493f Include filename in nosec 'no failed test' warning (#1363)
• b69b336 Fix B613 crash when reading from stdin (#1361)
• e418b79 Bump docker/build-push-action from 6.18.0 to 6.19.2 (#1357)
• ff646fd Bump docker/login-action from 3.6.0 to 3.7.0 (#1353)
• c0def6c chore: fixed some typos in comments (#1351)
• 765f00d Limit B614 to torch.load deserializers (#1348)
• 06fbbab Bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#1347)
• Additional commits viewable in compare view

Updates pip-tools from 7.4.1 to 7.6.0

Release notes

Sourced from pip-tools's releases.

v7.6.0

2026-07-13

Features

• The --help output for pip-compile and pip-sync commands has been extended to include usage examples -- by @​Dzhud.

  PRs and issues: #1142

• Added --uploaded-prior-to as a passthrough option for pip-compile, allowing users to restrict package candidates to versions uploaded before a given datetime. Requires pip >= 26.0 -- by @​miettal.

  PRs and issues: #2288

• pip-tools is now compatible with pip 26.1 -- @​gaborbernat.

  PRs and issues: #2379

Improved documentation

• Fixed the contents sidebar for the index doc -- by @​sirosen.

  PRs and issues: #2169

• pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by @​sirosen.

  Thanks to @​0cjs, @​gpshead, mr-@​c, @​samdoran, @​webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

  PRs and issues: #2318

• pip-tools' documentation now features a section titled "Reference" covering the CLI commands and configuration. Configuration documentation has been removed from the readme.

  -- by @​sirosen

Contributor-facing changes

• CI testing now runs on Intel and ARM macOS runners, and is pinned to a specific macOS version -- by @​sirosen.

  PRs and issues: #2079, #2132, #2348

• pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by @​sirosen.

  Thanks to @​0cjs, @​gpshead, mr-@​c, @​samdoran, @​webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

  PRs and issues: #2278, #2318

• Started running {pypi}zizmor as a part of CI pipelines to improve security of how we configure GitHub Actions CI/CD -- by @​webknjaz.

  PRs and issues: #2327

• pip-tools docs now support GitHub Flavored Markdown admonition blocks -- by @​webknjaz.

... (truncated)

Changelog

Sourced from pip-tools's changelog.

v7.6.0

2026-07-13

Features

• The --help output for pip-compile and pip-sync commands has been extended to include usage examples -- by {user}Dzhud.

  PRs and issues: {issue}1142

• Added --uploaded-prior-to as a passthrough option for pip-compile, allowing users to restrict package candidates to versions uploaded before a given datetime. Requires pip >= 26.0 -- by {user}miettal.

  PRs and issues: {issue}2288

• pip-tools is now compatible with pip 26.1 -- {user}gaborbernat.

  PRs and issues: {issue}2379

Improved documentation

• Fixed the contents sidebar for the index doc -- by {user}sirosen.

  PRs and issues: {issue}2169

• pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by {user}sirosen.

  Thanks to {user}0cjs, {user}gpshead, {user}mr-c, {user}samdoran, {user}webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

  PRs and issues: {issue}2318

• pip-tools' documentation now features a section titled "Reference" covering the CLI commands and configuration. Configuration documentation has been removed from the readme.

  -- by {user}sirosen

Contributor-facing changes

• CI testing now runs on Intel and ARM macOS runners, and is pinned to a specific macOS version -- by {user}sirosen.

  PRs and issues: {issue}2079, {issue}2132, {issue}2348

... (truncated)

Commits

• 27f6a96 Merge pull request #2420 from sirosen/release/v7.6.0
• cbe77f0 Apply suggestions from code review
• 015146e Update changelog for version 7.6.0
• 9a2d2c1 Merge pull request #2414 from jazzband/pre-commit-ci-update-config
• fc3f877 Merge pull request #2418 from jazzband/dependabot/pip/docs/soupsieve-2.8.4
• 5247a6b [pre-commit.ci] pre-commit autoupdate
• 3d1faf6 Bump soupsieve from 2.8.3 to 2.8.4 in /docs
• 57637db Merge pull request #2419 from sirosen/fix-test-failure
• 4695c37 Fix the fake_with_deps test package
• 24f4230 Merge pull request #2413 from webknjaz/maintenance/nested-zizmor-gha-workflow...
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[Llewellynvdm]

@dependabot rebase

[Llewellynvdm]

@dependabot rebase