build(deps-dev): bump the dev-dependencies group with 3 updates

[dependabot]

Bumps the dev-dependencies group with 3 updates: bandit, floki and req.

Updates bandit from 1.12.0 to 1.12.4

Changelog

Sourced from bandit's changelog.

1.12.4 (27 July 2026)

Fixes

• Properly send Connection: close header when client requests closure (#617)
• Disallow transfer-encoding on HTTP/1.0 connections (#618)
• Reject requests with multiple Host headers (#619)
• Reject malformed header lines (#620)
• Fix handling of chunk extensions (#621)

Enhancements

• Tighten up CI against supply chain attacks (#623, thanks @​Totara-thib!)
• Reorganize and increase coverage of HTTP/1 tests to better match RFC structure (#616)
• Tolerate a leading newline on HTTP/1 requests (#622)
• Send "100 Continue" interim response before reading body if client requests it (#624)

1.12.3 (25 July 2026)

Enhancements

• Cache connection-level data between HTTP/1 keepalives (#603, thanks @​preciz!)

1.12.2 (25 July 2026)

Enhancements

• Improve internal HTTP/2 error handling to be better about closing stream/connection
• Coalesce header and body in to single transport send (#606, thanks @​NelsonVides!)
• Improve compression behaviour when streaming an explicitly length delimited body (#605, thanks @​elibosley!)
• Quiet WebSocket deserialization errors, add verbosity config lever (#610, thanks @​ericmj!)
• Send connection: close when we're at max_requests (#613, thanks @​joshdchang!)

Fixes

• Fix bogus check for unmasked WebSocket frames (GHSA-rhh8-5xw9-c3gm, thanks @​lukaszsamson!)
• Enforce max_header_list_size if overridden (GHSA-9q5m-g6v3-6772, thanks @​lukaszsamson!)

1.12.1 (24 July 2026)

Fixes

• Fix DoS issue with fragmented WebSocket frames (CVE-2026-65623, thanks @​PJUllrich!)

Commits

• 00d532f Version bump to 1.12.4
• 1663203 Handle clients sending an Expect: 100-continue header before sending a body...
• e3c6595 Fixup linting error
• c430bf5 Reapply "Pin GitHub Actions to commit SHAs (#623)"
• a6fabe8 Revert "Pin GitHub Actions to commit SHAs (#623)"
• e479c3b Pin GitHub Actions to commit SHAs (#623)
• eba04e4 Tolerate a leading empty line before the request line (RFC9112§2.2) (#622)
• c31e9e3 Fix crash on unrecognized chunk extensions (#621)
• c24bc00 Reject header values containing CR, LF, or NUL (#620)
• a518b29 Reject requests with multiple Host headers (#619)
• Additional commits viewable in compare view

Updates floki from 0.38.3 to 0.38.4

Release notes

Sourced from floki's releases.

v0.38.4

Fixed

• Fix a regression with Floki.text/2 when a document contains a DOCTYPE tag.

  It did not appear for most of the users because the "mochiweb" parser (default) does not produce such tag.

  This is similar to the fix from v0.38.3.

  Thanks @​foxbenjaminfox.

Pull requests

• Fix Floki.text/2 when document contains a doctype declaration by @​foxbenjaminfox in philss/floki#702
• Bump versions for Elixir and Ubuntu - CI workflow by @​philss in philss/floki#703
• Release v0.38.4 by @​philss in philss/floki#704

New Contributors

• @​foxbenjaminfox made their first contribution in philss/floki#702

Full Changelog: philss/floki@v0.38.3...v0.38.4

Changelog

Sourced from floki's changelog.

[0.38.4] - 2026-06-15

Fixed

• Fix a regression with Floki.text/2 when a document contains a DOCTYPE tag. It did not appear for most of the users because the "mochiweb" parser (default) does not produce such tag.

  This is similar to the fix from v0.38.3.

  Thanks @​foxbenjaminfox.

Fixed

Commits

• 143df1f Release v0.38.4 (#704)
• 3bd1d99 Bump versions for Elixir and Ubuntu - CI workflow (#703)
• 2db3aa3 Fix Floki.text/2 when document contains a doctype declaration (#702)
• See full diff in compare view

Updates req from 0.6.1 to 0.7.2

Changelog

Sourced from req's changelog.

v0.7.2

• [encode_body]: Bring back form_multipart: [{string_name, value}].
• [put_aws_sigv4]: Fix AWS SigV4 compatibility with Supabase Storage S3.

v0.7.1 (2026-07-28)

• Deprecate cache: true/[cache] step. It will be removed in Req v0.8. I plan a comprehensive cache solution for Req v1.0+.

v0.7.0 (2026-07-28)

• [Req]: Add Req.new(req, options).

• [Req]: Treat URL userinfo as Basic Authentication.

• [Req], [Req.Request]: Deprecate adapter: fun in favour of adapter: mod.

• [Req.Request]: (BREAKING CHANGE) Remove current_request_steps field.

• [Req.Request]: Fix redacting remaining auth values.

• (BREAKING CHANGE) Replace run_finch step with [Req.Finch] adapter module.

• (BREAKING CHANGE) Replace put_plug and run_plug steps with [Req.Plug] adapter module.

• [Req.Finch]: Support finch: options.

• [Req.Finch]: Support :request_timeout.

• [Req.Finch]: Fix handling duplicate response headers.

• [Req.Finch]: Deprecate finch: name in favour of finch: [name: name].

• [Req.Finch]: Deprecate pool_timeout: value in favour of finch: [pool_timeout: value].

• [Req.Finch]: Deprecate pool_max_idle_time: value in favour of finch: [pool_max_idle_time: value].

• [Req.Finch]: Deprecate :finch_request.

• [Req.Plug]: Handle individual response body chunks.

• [Req.Plug]: Support non-UTF8 request params.

• [Req.Plug]: Put original request private data in conn.private.

• [Req.Test]: Allow descendant processes.

• [Req.Test]: Fix concurrent plug fetches immediately after switching to shared mode.

• [compress_body]: Do nothing when request content-encoding is already set.

... (truncated)

Commits

• c136357 Release v0.7.2
• e9d4ebc Fix AWS SigV4 compatibility with Supabase Storage S3 (#498)
• 168a11e Release v0.7.1
• a9c24a1 Deprecate cache: true/cache step
• 6a4f305 Release v0.7.0
• d770830 Hide body: fun for now
• e450b25 Update CI
• 8123419 Fix flaky httpc into: fun test
• fb7bb10 Revert "New step: expect (#493)"
• ed894af Revert "Add assigns (#492)"
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions