chore(deps): bump bandit from 1.12.4 to 1.12.5 in /elixir-orchestration

[dependabot]

Bumps bandit from 1.12.4 to 1.12.5.

Changelog

Sourced from bandit's changelog.

1.12.5 (20 Aug 2026)

Changes

• Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532w-jv94) (#671)
• Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings (#665)
• Treat proxy-connection as a connection-specific header in HTTP/2 (#632)
• Return FRAME_SIZE_ERROR for HEADERS/DATA frames too short for their flags (#652)
• Treat abortive-close posix reasons as client closures in logging (#663)

Fixes

• Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) (#670)
• Use PROTOCOL_ERROR for a zero WINDOW_UPDATE increment (#656)
• Reject send_file ranges past EOF instead of emitting a negative Content-Length (#653)
• Reject compressed WebSocket control frames regardless of the fin bit (#651)
• Enforce the RFC9112 chunk-size grammar and reject repeated transfer-encoding (#631)
• Fix typos (#627)
• Fix non-deterministic compile-time code (#646)

Enhancements

• Lazily precompile the invalid-field-value match pattern (#662)
• Add tests for untested configuration options (#659)
• Match the weak-etag prefix W/ explicitly (#657)
• Do not duplicate an existing vary: accept-encoding header (#658)
• Honor the close/keep-alive token inside a comma-separated Connection header (#655)
• Initialize the per-stream receive window from the advertised initial_window_size (#654)
• Keep track of body_length to avoid list iterations (#645)
• Avoid per-header length/1 and option lookups in do_read_headers! (#614) (#626)

Commits

• 9571499 Version bump to 1.12.5
• f6914aa Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532...
• d38cf04 Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) (#670)
• cce7c5f Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings (#...
• eca1713 Fixup recent test noise
• b65c235 Consolidate Plug.Conn.Adapter calling-process tests into adapter_test.exs (#667)
• 4ccc008 Treat abortive-close posix reasons as client closures in logging (#663)
• 274eb55 Lazily precompile the invalid-field-value match pattern (#662)
• 10710de Enforce the chunk-size grammar in a single pass (#661)
• d69202e Unify case-insensitive comma-separated header token checks (#660)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The PR addresses security vulnerabilities GHSA-xj8g-532w-jv94 and GHSA-x3gh-xhj4-3vq8. While the changes meet project standards, the update is restricted to the lockfile. This introduces a risk where the update could be overridden if the dependency is pinned in the project specification file.

About this PR

• The update is currently only reflected in the lockfile. Ensure the project's dependency specification is compatible with the update to prevent resolution conflicts or the change being reverted in future builds.

Test suggestions

• Basic integration test to ensure the server starts and handles requests after the dependency update

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Basic integration test to ensure the server starts and handles requests after the dependency update

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 8c524ab4-82fc-48a2-84a7-6b9b14b942f8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}