Skip to content

build(deps): bump the pip group across 2 directories with 10 updates - #4074

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/integrations/bbot/pip-fc3e354b15
Open

build(deps): bump the pip group across 2 directories with 10 updates#4074
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/integrations/bbot/pip-fc3e354b15

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip group with 1 update in the /integrations/bbot directory: bbot.
Bumps the pip group with 9 updates in the /requirements directory:

Package From To
django 4.2.27 5.2.17
authlib 1.6.5 1.6.12
djangorestframework 3.15.2 3.17.2
daphne 4.2.1 4.2.2
gitpython 3.1.41 3.1.62
pillow 11.0.0 12.3.0
pyzipper 0.3.6 0.4.0
lxml 6.0.2 6.1.0
pycti 6.8.8 6.9.7

Updates bbot from 2.7.2 to 3.0.0

Release notes

Sourced from bbot's releases.

3.0.0

BBOT 3.0.0

[!WARNING] Upgrading from 2.x is not drop-in. The CLI, flags, preset syntax, event API, config keys, and module set all changed in backwards-incompatible ways. Read the 2.x to 3.0 migration guide before upgrading. The changes most likely to bite:

  • -s now means --seeds, not --silent (silent moved to -S). A script passing -s for quiet output will now add a seed instead, with no error.
  • --whitelist was retired: -t/--targets now defines scope, and -s/--seeds drives the scan.
  • --allow-deadly was removed, and several flags were renamed (e.g. noisy to loud).
  • Module options are now pydantic-validated; the legacy options dict hard-fails.
  • Some event types, event attributes, and config keys were renamed or removed.

Highlights

  • New HTTP engine (blasthttp): in-process, rate-limited HTTP replacing the httpx subprocess (#2992, #3021)
  • New DNS engine (BlastDNS) (#3042)
  • Pydantic config + preset validation: typos and type errors are caught before a scan starts (#2486, #3058)
  • Scope rework: clean split between target (scope) and seeds (drivers); --whitelist retired (#2789)
  • Findings and Vulnerabilities unified, with Severity and Confidence (#2436, #2740)
  • asndb: faster ASN enrichment, plus ASNs usable as scan targets (#2957, #2741)
  • Lightfuzz overhaul: new SSRF and ESI submodules, far fewer false positives (#2967)
  • Major performance work: memory and CPU optimizations, bounded DNS caches, HTTP body stripping, string interning (#2953, #3085, #3088)
  • Preset naming / tag standardization across flags, presets, and event tags (#2986)
  • New modules: MongoDB / Elastic / Kafka / RabbitMQ / ZeroMQ / NATS outputs, legba, trajan, virtualhost, waf_bypass, dnsspf, Hetzner bucket
  • Modules removed: wappalyzer, smuggler, digitorus, sitedossier, passivetotal, wpscan

Core & Packaging

  • Packaging moved from Poetry to uv + hatchling, and supported Python is now 3.10 - 3.14 (#2900, #2731).
  • Config values and presets are validated with pydantic before a scan runs, so typos and wrong types fail fast instead of silently doing nothing. The legacy per-module options dict is no longer accepted (#2486, #3058, #3119).
  • Malformed YAML in a config or preset now produces a readable error instead of a stack trace (#3159).
  • New --reset-config / --reset-secrets to regenerate stale config files (#3240).

Scope & Targeting

  • Scope was reworked around a target/seeds split: -t/--targets defines scope, -s/--seeds supplies the starting events, --whitelist is gone, and --strict-scope now means "this exact host only" (#2789).
  • ASNs can be used directly as scan targets (#2741).
  • Files can be passed as targets, seeds, or blacklist entries inside presets, and target lists may contain comments (#2996, #3031).

HTTP & Web

  • All web traffic now runs in-process through one shared, rate-limited client (blasthttp) instead of a separate httpx subprocess (#2992, #3021).
  • HTTP wildcard/catch-all host detection cuts false positives on servers that answer every request (#3164).
  • 429 Too Many Requests responses are now honored for rate limiting (#3145).
  • HTTP timeout settings were consolidated into one place (#3222).
  • SSL verification was split so BBOT verifies its own infrastructure calls by default while still not verifying untrusted target traffic (#3186).

DNS

... (truncated)

Changelog

Sourced from bbot's changelog.

2.8.6 - Jun 16, 2026

2.8.5 - Jun 16, 2026

2.8.4 - Mar 17, 2026

2.8.3 - Feb 26, 2026

2.8.2 - Feb 12, 2026

2.8.1 - Jan 30, 2026

2.8.0 - Jan 20, 2026

Commits

Updates django from 4.2.27 to 5.2.17

Commits
  • e802ada [5.2.x] Bumped version for 5.2.17 release.
  • b9adb81 [5.2.x] Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before...
  • ba80833 [5.2.x] Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry c...
  • c72a5db [5.2.x] Fixed CVE-2026-15337 -- Mitigated potential DoS in check_for_language().
  • 115ffd0 [5.2.x] Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial l...
  • ec5ced4 [5.2.x] Fixed #36770 -- Fixed incomplete mocking in SQLiteInMemoryTestDbs.
  • 02369b5 [5.2.x] Allowed the full Python test matrix to run on GitHub Actions.
  • 686072f [5.2.x] Added stub release notes and release date for 5.2.17.
  • cd5ad8c [5.2.x] Bumped minimum setuptools version to 83.
  • 3e389b7 [5.2.x] Closed temporary files in GDALRasterTests.
  • Additional commits viewable in compare view

Updates authlib from 1.6.5 to 1.6.12

Release notes

Sourced from authlib's releases.

v1.6.12

v1.6.11

Full Changelog: authlib/authlib@v1.6.10...v1.6.11

  • Fix CSRF issue with starlette client

v1.6.10

Full Changelog: authlib/authlib@v1.6.9...v1.6.10

  • Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

v1.6.9

Full Changelog: authlib/authlib@v1.6.8...v1.6.9

Changes in jose module

  • Not using header's jwk automatically
  • Add ES256K into default jwt algorithms
  • Remove deprecated algorithm from default registry
  • Generate random cek when cek length doesn't match

v1.6.8

Full Changelog: authlib/authlib@v1.6.7...v1.6.8

  • Add EdDSA to default jwt instance.

v1.6.7

Full Changelog: authlib/authlib@v1.6.6...v1.6.7

Set supported algorithms for the default jwt instance.

v1.6.6

What's Changed

New Contributors

Full Changelog: authlib/authlib@v1.6.5...v1.6.6

Changelog

Sourced from authlib's changelog.

Version 1.6.12

Released on may 4, 2026

  • Fix redirecting to unvalidated redirect_uri on InvalidScopeError in OpenIDImplicitGrant and OpenIDHybridGrant.

Version 1.6.11

Released on Apr 16, 2026

  • Fix CSRF vulnerability in the Starlette OAuth client when a cache is configured.

Version 1.6.10

Released on Apr 13, 2026

  • Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Version 1.6.9

Released on Mar 2, 2026

  • Not using header's jwk automatically.
  • Add ES256K into default jwt algorithms.
  • Remove deprecated algorithm from default registry.
  • Generate random cek when cek length doesn't match.

Version 1.6.8

Released on Feb 17, 2026

  • Add EdDSA to default jwt instance.

Version 1.6.7

Released on Feb 6, 2026

  • Set supported algorithms for the default jwt instance.

Version 1.6.6

... (truncated)

Commits
  • e46e515 chore: bump to 1.6.12
  • 9babc13 fix: redirecting to unvalidated redirect_uri on InvalidScopeError in OIDC grants
  • 0dc0e5b chore: bump to 1.6.11
  • aa7b8e4 Merge commit from fork
  • 401a770 fix: CSRF issue with starlette client
  • ef09aeb chore: release 1.6.10
  • 3be0846 fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError
  • 9266eaa chore: release 1.6.9
  • b9bb2b2 fix(oidc): fail close at validating c_hash and at_hash
  • 1b0a1d9 fix(jose): generate random cek when cek length doesn't match
  • Additional commits viewable in compare view

Updates djangorestframework from 3.15.2 to 3.17.2

Release notes

Sourced from djangorestframework's releases.

3.17.2

What's Changed

Bug fixes

Full Changelog: encode/django-rest-framework@3.17.1...3.17.2

3.17.1

What's Changed

Bug fixes

Full Changelog: encode/django-rest-framework@3.17.0...3.17.1

3.17.0

What's Changed

Breaking changes

Features

Bug fixes

Translations

... (truncated)

Commits
  • ad309f3 Release 3.17.2 (#10014)
  • 2912dc9 Enforce DATA_UPLOAD_MAX_MEMORY_SIZE for request.data parsing (#10013)
  • 71f8194 Fix disclosure of GET-protected data in case of validation error with `AdminR...
  • 22e231c Prepare bug fix release 3.17.1 (#9931)
  • 8e99b53 Add condition to skip pushed tags from forks (#9924)
  • c0407de Fix HTMLFormRenderer with empty datetime values (#9928)
  • 30d58a7 Fix the book sizing in the documentation (#9926)
  • 6f03b79 Tweak order of changes in release notes
  • 021ab56 Bump version and update release notes for 3.17.0 (#9921)
  • 19ebad7 Bump mkdocs-material[imaging] from 9.7.4 to 9.7.5 (#9923)
  • Additional commits viewable in compare view

Updates daphne from 4.2.1 to 4.2.2

Changelog

Sourced from daphne's changelog.

4.2.2 (2026-06-03)

  • Fixed a denial of service vulnerability via unbounded WebSocket message sizes. Daphne previously passed no message or frame size limits to autobahn, whose defaults are unbounded. This allowed an unauthenticated client to exhaust server memory by sending a very large WebSocket messages/frames (CVE-2026-44545).

    Both limits now default to 1 MiB and can be configured via the new --websocket-max-message-size and --websocket-max-frame-size CLI flags (or the matching Server constructor arguments). Pass 0 to restore the previous unlimited behaviour.

    Thanks to ParkHyunWoo for the report.

  • Fixed a header injection vulnerability on the WebSocket upgrade path (CVE-2026-44546).

    Header values containing \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 were parsed as a single header by Twisted but split into multiple headers by autobahn during the WebSocket handshake. An attacker could exploit this parser differential to smuggle additional headers (e.g. authentication tokens, X-Forwarded-For, Origin, Daphne-Root-Path) into the ASGI scope passed to the application.

    Daphne now rejects requests carrying these bytes in any header value with a 400 Bad Request response, as required by RFC 9110 §5.5.

    Thanks to Rene Henningsen for the report.

Commits

Updates gitpython from 3.1.41 to 3.1.62

Release notes

Sourced from gitpython's releases.

3.1.62

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.61...3.1.62

3.1.61

Fix accidental removal of exploitable regex in Actor by bringing it back, and deprecating it.

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.60...3.1.61

3.1.60 Security

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.59...3.1.60

3.1.59 - Security

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.58...3.1.59

3.1.58 - Security and Fixes

What's Changed

... (truncated)

Commits
  • db47516 prepare new release
  • 10ec385 get better commit messages from agents
  • b754897 test: cover subdirectory discovery and pathspec commands in bare-repo worktre...
  • 9ebf8b6 Merge pull request #2227 from nkbeast/fix-config-backslash-continuation
  • a15f791 fix: parse joined config values as a whole
  • 60dd946 fix: ignore continuation markers in config comments
  • 075a664 fix: join backslash line continuations when reading config values
  • 62d1e2f Merge pull request #2226 from gitpython-developers/dependabot/pre_commit/pre-...
  • 23d0e92 build(deps): bump https://github.com/astral-sh/ruff-pre-commit
  • 8a14adc Merge pull request #2225 from gitpython-developers/submodule-path-hardening
  • Additional commits viewable in compare view

Updates pillow from 11.0.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Documentation

Dependencies

Testing

... (truncated)

Changelog

Sourced from pillow's changelog.

Changelog (Pillow)

11.1.0 and newer

See GitHub Releases:

Commits
  • bb1d8e8 12.3.0 version bump
  • e63fc48 Add release notes for SBOM and performance improvements (#9747)
  • 13b701b Add release notes for #9679
  • 5564ca7 List methods
  • a0920fd Speed up ImageChops operations (#9738)
  • 07e9a6c Speed up Image.filter() (#9736)
  • a94578c Speed up Image.getchannel(), Image.merge(), Image.putalpha() and `Image...
  • 53e02c4 Speed up Image.fill(), Image.linear_gradient() and `Image.radial_gradient...
  • af03747 Speed up Image.resample() (#9739)
  • 5c9ca56 Speed up alpha_composite, matrix, negative, quantize (#9740)
  • Additional commits viewable in compare view

Updates pyzipper from 0.3.6 to 0.4.0

Changelog

Sourced from pyzipper's changelog.

0.4.0 (2026-05-13)

  • Update package to use pyproject.toml
  • Fix bug where CRC32 values were not removed for small files (CVE-2026-44722). pyzipper no longer writes any CRC32 values by default, regardless of file size. The CRC32 value could be used to brute-force candidate plaintexts by computing CRC32(candidate) and comparing against the stored value. In practice, this attack is feasible today only against small or low-entropy files, as CRC32 exhaustion across a large plaintext space is computationally prohibitive on current hardware.
Commits
  • a814388 Merge commit from fork
  • 6836583 Update test to loop through all compression methods
  • 4c23f26 Update README to include information about the CRC bug
  • 9d2a95c Fix README.rst block quote
  • 43b001b Update HISTORY.rst and version
  • bf7a6bd Add SECURITY.rst
  • 85ce9a5 Update README.rst with CRC information
  • 93ce88e Remove CRC32 values from file entries for small files (CVE-2026-44722)
  • 919e199 Merge pull request #42 from danifus/update202605
  • 61d3529 Quote python versions in github workflow to fix 3.10
  • Additional commits viewable in compare view

Updates lxml from 6.0.2 to 6.1.0

Changelog

Sourced from lxml's changelog.

6.1.0 (2026-04-17)

This release fixes a possible external entity injection (XXE) vulnerability in iterparse() and the ETCompatXMLParser.

Features added

  • GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes in lxml.html.defs. This allows lxml_html_clean to pass them through. Patch by oomsveta.

  • The default chunk size for reading from file-likes in iterparse() is now configurable with a new chunk_size argument.

Bugs fixed

  • LP#2146291: The resolve_entities option was still set to True for iterparse and ETCompatXMLParser, allowing for external entity injection (XXE) when using these parsers without setting this option explicitly. The default was now changed to 'internal' only (as for the normal XML and HTML parsers since lxml 5.0). Issue found by Sihao Qiu as CVE-2026-41066.

6.0.4 (2026-04-12)

Bugs fixed

  • LP#2148019: Spurious MemoryError during namespace cleanup.

6.0.3 (2026-04-09)

Bugs fixed

  • Several out of memory error cases now raise MemoryError that were not handled before.

  • Slicing with large step values (outside of +/- sys.maxsize) could trigger undefined C behaviour.

  • LP#2125399: Some failing tests were fixed or disabled in PyPy.

  • LP#2138421: Memory leak in error cases when setting the public_id or system_url of a document.

... (truncated)

Commits
  • 43722f4 Update changelog.
  • 8747040 Name version of option change in docstring.
  • 6c36e6c Fix pypistats URL in download statistics script.
  • c7d76d6 Change security policy to point to Github security advisories.
  • 378ccf8 Update project income report.
  • 315270b Docs: Reduce TOC depth of package pages and move module contents first.
  • 6dbba7f Docs: Show current year in copyright line.
  • e4385bf Update project income report.
  • 5bed1e1 Validate file hashes in release download script.
  • c13ee10 Prepare release of 6.1.0.
  • Additional commits viewable in compare view

Updates pycti from 6.8.8 to 6.9.7

Release notes

Sourced from pycti's releases.

Version 6.9.7

Enhancements:

  • #13990 Implement new inference rules
  • #13975 Support multiple files upload at creation of entities
  • #13971 [client] Upload file at creation of entities instead of after the creation
  • #13944 [client] Add support of file download during import process
  • #11383 Create inference rule on attribution
  • #10505 [Rules Engine] If Report contains IP, and IP belongs to ASN then Report contains ASN

Bug Fixes:

  • #13940 Unable to add personal notifiers
  • #13933 Redirect the learn more of the OCTI demo banner to the Hub public trial page
  • #13901 Users add relations in orga admin context
  • #13897 Status renaming is not taken into account
  • #13888 Form Intakes cannot be launched when using "Toggle" field type on Malware is_family
  • #13818 AI Insights returns text in Markdown format instead of HTML.
  • #13792 Campaigns do not display Security Coverage Icons if there is an Associated Security Coverage
  • #13753 Simple Mailer {"variableName":"escape"} Error
  • #13624 Channel Entity Does Not Display Channel Type in GUI
  • #13610 Domain import fails when using “domain name” in CSV Mapper
  • #13058 Generated PDFs of RSS Feed For The Record Are Not Properly Created
  • #12445 "Interval" for the bookmark widget serves no purpose
  • #11800 GraphQL internal server error

Pull Requests:

@dependabot
build(deps): bump the pip group across 2 directories with 10 updates
a7cc3ba 
Bumps the pip group with 1 update in the /integrations/bbot directory: [bbot](https://github.com/blacklanternsecurity/bbot).
Bumps the pip group with 9 updates in the /requirements directory:

| Package | From | To |
| --- | --- | --- |
| [django](https://github.com/django/django) | `4.2.27` | `5.2.17` |
| [authlib](https://github.com/authlib/authlib) | `1.6.5` | `1.6.12` |
| [djangorestframework](https://github.com/encode/django-rest-framework) | `3.15.2` | `3.17.2` |
| [daphne](https://github.com/django/daphne) | `4.2.1` | `4.2.2` |
| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.41` | `3.1.62` |
| [pillow](https://github.com/python-pillow/Pillow) | `11.0.0` | `12.3.0` |
| [pyzipper](https://github.com/danifus/pyzipper) | `0.3.6` | `0.4.0` |
| [lxml](https://github.com/lxml/lxml) | `6.0.2` | `6.1.0` |
| [pycti](https://github.com/OpenCTI-Platform/opencti) | `6.8.8` | `6.9.7` |



Updates `bbot` from 2.7.2 to 3.0.0
- [Release notes](https://github.com/blacklanternsecurity/bbot/releases)
- [Changelog](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/release_history.md)
- [Commits](https://github.com/blacklanternsecurity/bbot/commits/v3.0.0)

Updates `django` from 4.2.27 to 5.2.17
- [Commits](django/django@4.2.27...5.2.17)

Updates `authlib` from 1.6.5 to 1.6.12
- [Release notes](https://github.com/authlib/authlib/releases)
- [Changelog](https://github.com/authlib/authlib/blob/v1.6.12/docs/changelog.rst)
- [Commits](authlib/authlib@v1.6.5...v1.6.12)

Updates `djangorestframework` from 3.15.2 to 3.17.2
- [Release notes](https://github.com/encode/django-rest-framework/releases)
- [Commits](encode/django-rest-framework@3.15.2...3.17.2)

Updates `daphne` from 4.2.1 to 4.2.2
- [Changelog](https://github.com/django/daphne/blob/main/CHANGELOG.txt)
- [Commits](django/daphne@4.2.1...4.2.2)

Updates `gitpython` from 3.1.41 to 3.1.62
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@3.1.41...3.1.62)

Updates `pillow` from 11.0.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@11.0.0...12.3.0)

Updates `pyzipper` from 0.3.6 to 0.4.0
- [Changelog](https://github.com/danifus/pyzipper/blob/master/HISTORY.rst)
- [Commits](danifus/pyzipper@v0.3.6...v0.4.0)

Updates `lxml` from 6.0.2 to 6.1.0
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-6.0.2...lxml-6.1.0)

Updates `pycti` from 6.8.8 to 6.9.7
- [Release notes](https://github.com/OpenCTI-Platform/opencti/releases)
- [Commits](OpenCTI-Platform/opencti@6.8.8...6.9.7)

---
updated-dependencies:
- dependency-name: bbot
  dependency-version: 3.0.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: django
  dependency-version: 5.2.17
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: authlib
  dependency-version: 1.6.12
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: djangorestframework
  dependency-version: 3.17.2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: daphne
  dependency-version: 4.2.2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: gitpython
  dependency-version: 3.1.62
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pyzipper
  dependency-version: 0.4.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: lxml
  dependency-version: 6.1.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pycti
  dependency-version: 6.9.7
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Oct 12, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants