Skip to content

Update bandit requirement from >=1.7 to >=1.9.4 in /services/api - #284

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/services/api/bandit-gte-1.9.4
Closed

Update bandit requirement from >=1.7 to >=1.9.4 in /services/api#284
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/services/api/bandit-gte-1.9.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 14, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on bandit to permit the latest version.

Release notes

Sourced from bandit's releases.

1.9.4

What's Changed

New Contributors

Full Changelog: PyCQA/bandit@1.9.3...1.9.4

Commits
  • 92ae8b8 Fix B106 reporting wrong line number on multiline function calls (#1360)
  • c8c8a55 Lower version guard in check_ast_node to Python 3.12 (#1355)
  • 8f2f928 Fix B615 false positive when revision is set via variable (#1358)
  • e27493f Include filename in nosec 'no failed test' warning (#1363)
  • b69b336 Fix B613 crash when reading from stdin (#1361)
  • e418b79 Bump docker/build-push-action from 6.18.0 to 6.19.2 (#1357)
  • ff646fd Bump docker/login-action from 3.6.0 to 3.7.0 (#1353)
  • c0def6c chore: fixed some typos in comments (#1351)
  • 765f00d Limit B614 to torch.load deserializers (#1348)
  • 06fbbab Bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#1347)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Update bandit requirement from >=1.7 to >=1.9.4 in /services/api
61a02f3 
Updates the requirements on [bandit](https://github.com/PyCQA/bandit) to permit the latest version.
- [Release notes](https://github.com/PyCQA/bandit/releases)
- [Commits](PyCQA/bandit@1.7.0...1.9.4)

---
updated-dependencies:
- dependency-name: bandit
  dependency-version: 1.9.4
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 14, 2026
@strix-security

strix-security Bot commented Aug 14, 2026

Copy link
Copy Markdown

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

So far, Strix has reviewed 28 pull requests, surfaced 3 security issues (1 critical/high) and blocked 2 risky merges across this workspace.

ibuilder added a commit that referenced this pull request Aug 18, 2026
@ibuilder @claude
v0.3.984 - the dependabot bumps were incomplete, and the lock is what…
675c129 
… CI installs

Five npm dev-dependency upgrades, applied together and verified as ONE state:
eslint 10.8.0 -> 10.8.1, globals 17.7 -> 17.11, happy-dom 20.8.9 -> 20.11.2,
typescript-eslint 8.65 -> 8.67, vite 8.1.5 -> 8.2.1 (dependabot #278 #280 #283
#285 #287). Applied in one commit rather than merged one by one because all five
rewrite package-lock.json and would have conflicted pairwise.

DEPENDABOT COULD NOT SEE THE WHOLE PICTURE. The ROOT workspace declares vite,
eslint and happy-dom too; dependabot only opened PRs against apps/web. So merging
them as-is would have changed less than they claimed:

  * eslint would have stayed on the root's 10.8.0 - hoisted, so the apps/web bump
    was a NO-OP for linting, the very tool the bump exists to update;
  * vite would have been installed TWICE - root's exact 8.1.5 against web's exact
    8.2.1, forcing a nested second copy.

Both roots are aligned; all five now resolve to single hoisted copies at the
intended versions, confirmed by reading node_modules rather than the manifest.

There is also an `overrides` block pinning eslint repo-wide that dependabot never
touches. The first edit landed on IT instead of the devDependency - the same key
lives in both sections and a count-limited replace takes whichever comes first.
npm rejected it loudly (EOVERRIDE), which is the good case. Both now read 10.8.1
and are asserted equal.

toolchainDocs.test.ts then caught the third thing: docs/engineering/web-standards.md
still said "eslint 10.8.0". A governed doc whose versions are asserted against the
manifest - and whose own comment records that both versions there were wrong for
weeks once before.

THE SEVEN PYTHON PRs ARE NOT MERGED HERE, deliberately. CI installs from
services/api/requirements.lock with --require-hashes, NOT requirements.txt, and
those PRs only raise >= floors:

  * #289 manifold3d, #286 fastapi, #282 shapely, #284 bandit - the lock already
    pins versions satisfying the new floors; safe, purely making the declaration
    honest.
  * #277 numpy, #281 trimesh, #288 boto3 - raise the floor ABOVE what the lock
    pins (2.5.1, 4.12.2, 1.43.46). test_lock_satisfies_requirements.py guards
    exactly this and was mutation-tested by simulating #281. Merging without a
    lock regeneration reds main - and CI would still install the old versions, so
    a green run would prove nothing about trimesh 5.

Web typecheck + lint clean, 1651/1651, build OK. Backend 608/608 (the one failure
in the first run was test_changelog_current doing its job: version bumped before
this entry existed).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ibuilder added a commit that referenced this pull request Aug 18, 2026
@ibuilder @claude
v0.3.985 - four declared floors made honest, three refused
d28f8d2 
Four Python floor bumps applied (dependabot #289 manifold3d, #286 fastapi, #282
shapely, #284 bandit). Each raises a >= floor to a version the lock ALREADY pins,
so nothing about what installs changes - the declaration simply stops understating
what the project requires. test_lock_satisfies_requirements: 50 floors, 110 pins.

The other three are refused. #277 numpy (lock 2.5.1), #281 trimesh (4.12.2, a
major) and #288 boto3 (1.43.46) raise the floor ABOVE the lock. Two independent
reasons: the lock gate would go red (mutation-tested by simulating #281, which
fails naming the package, both versions and the line), and CI installs from
requirements.lock with --require-hashes, so merging them would produce a green run
that tested the OLD versions. A floor bump is a claim about what is required; only
a lock regeneration changes what is USED.

Two things the mapping turned up, both from checking rather than assuming:

  * services/api/requirements.txt DOES NOT EXIST. The source is requirements.in,
    compiled to requirements.lock. A first pass looking for the .txt found nothing
    and would have read as "these packages are undeclared".
  * shapely is declared in TWO files - requirements.in at >=2.0 and
    services/data/requirements.txt at >=2.1.2. Reading the wrong one makes #282
    look already applied. Edits are line-anchored and assert exactly one match, so
    a floor like >=2.0 cannot silently match inside >=2.0.1.

Backend 608/608; all five dependency gates pass (lock-satisfies, licence-lock,
lock-advisories, licence-allowlist, vendor-drift).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@ibuilder

ibuilder commented Aug 18, 2026

Copy link
Copy Markdown
Owner

Applied in d28f8d2 (v0.3.985), together with the other three safe floor bumps in one verified commit.

This floor was raised to a version services/api/requirements.lock already pins, so nothing about what installs changes — the declaration just stops understating what the project requires. test_lock_satisfies_requirements.py confirms: 50 floors against 110 pins. Backend 608/608.

Applied rather than merged so all four could be verified as one state, and because the mapping needed checking first: services/api/requirements.txt does not exist (the source is requirements.in), and shapely is declared in two files at different floors.

@ibuilder ibuilder closed this Aug 18, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 18, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/pip/services/api/bandit-gte-1.9.4 branch August 18, 2026 15:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ibuilder