Bump bandit from 1.8.6 to 1.9.2 by dependabot[bot] · Pull Request #311 · senzing-garage/sz-python-tools

dependabot · 2026-01-05T22:14:03Z

Bumps bandit from 1.8.6 to 1.9.2.

Release notes

1.9.2

What's Changed

Argparse Python 3.14 enhancements by @ericwb in PyCQA/bandit#1331

Check whether Constant value is str by @ericwb in PyCQA/bandit#1333

Full Changelog: PyCQA/bandit@1.9.1...1.9.2

1.9.1

What's Changed

More Python version related fixes by @ericwb in PyCQA/bandit#1327

Full Changelog: PyCQA/bandit@1.9.0...1.9.1

1.9.0

What's Changed

Add instructions for Maintainers to create/publish a release by @ericwb in PyCQA/bandit#1275

Bump sigstore/cosign-installer from 3.9.1 to 3.9.2 by @dependabot[bot] in PyCQA/bandit#1289

Bump docker/login-action from 3.4.0 to 3.5.0 by @dependabot[bot] in PyCQA/bandit#1290

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in PyCQA/bandit#1291

Bump actions/checkout from 4 to 5 by @dependabot[bot] in PyCQA/bandit#1292

Replace deprecated datetime.datetime.utcnow() by @purplezimmermann in PyCQA/bandit#1295

Bump actions/setup-python from 5 to 6 by @dependabot[bot] in PyCQA/bandit#1296

Bump sigstore/cosign-installer from 3.9.2 to 3.10.0 by @dependabot[bot] in PyCQA/bandit#1298

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in PyCQA/bandit#1303

Fix typos by @Shortfinga in PyCQA/bandit#1305

Bump docker/login-action from 3.5.0 to 3.6.0 by @dependabot[bot] in PyCQA/bandit#1306

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in PyCQA/bandit#1315

Bump sigstore/cosign-installer from 3.10.0 to 4.0.0 by @dependabot[bot] in PyCQA/bandit#1317

Support of Python 3.14 by @ericwb in PyCQA/bandit#1323

Drop support of end-of-life Python 3.9 by @ericwb in PyCQA/bandit#1325

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in PyCQA/bandit#1324

New Contributors

@purplezimmermann made their first contribution in PyCQA/bandit#1295

@Shortfinga made their first contribution in PyCQA/bandit#1305

Full Changelog: PyCQA/bandit@1.8.6...1.9.0

Commits

ea0d187 Check whether Constant value is str (#1333)
8bf7594 Argparse Python 3.14 enhancements (#1331)
a255dfa More Python version related fixes (#1327)
3f07bb0 [pre-commit.ci] pre-commit autoupdate (#1324)
c8c3fb8 Drop support of end-of-life Python 3.9 (#1325)
5c30350 Support of Python 3.14 (#1323)
e1ffdf6 Bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#1317)
176d4ca [pre-commit.ci] pre-commit autoupdate (#1315)
2fc3e9c Bump docker/login-action from 3.5.0 to 3.6.0 (#1306)
6a68546 Fix typos (#1305)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Resolves #1333
Resolves #1331
Resolves #1327
Resolves #1324
Resolves #1325
Resolves #1323
Resolves #1317
Resolves #1315
Resolves #1306
Resolves #1305
Resolves PyCQA/bandit#1331
Resolves PyCQA/bandit#1333
Resolves PyCQA/bandit#1327
Resolves PyCQA/bandit#1275
Resolves PyCQA/bandit#1289
Resolves PyCQA/bandit#1290
Resolves PyCQA/bandit#1291
Resolves PyCQA/bandit#1292
Resolves PyCQA/bandit#1295
Resolves PyCQA/bandit#1296
Resolves PyCQA/bandit#1298
Resolves PyCQA/bandit#1303
Resolves PyCQA/bandit#1305
Resolves PyCQA/bandit#1306
Resolves PyCQA/bandit#1315
Resolves PyCQA/bandit#1317
Resolves PyCQA/bandit#1323
Resolves PyCQA/bandit#1325
Resolves PyCQA/bandit#1324

Bumps [bandit](https://github.com/PyCQA/bandit) from 1.8.6 to 1.9.2. - [Release notes](https://github.com/PyCQA/bandit/releases) - [Commits](PyCQA/bandit@1.8.6...1.9.2) --- updated-dependencies: - dependency-name: bandit dependency-version: 1.9.2 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-01-05T22:15:22Z

🤖 Claude Code Review

Code Review Analysis

Summary

This PR updates the bandit dependency from version 1.8.6 to 1.9.2 in the lint dependencies.

Detailed Review

Code Quality ✅

✅ Code follows style guide: This is a dependency version update in pyproject.toml, which follows standard TOML formatting.
✅ No commented-out code: None present.
✅ Meaningful variable names: N/A - dependency declaration.
✅ DRY principle followed: N/A - single line change.
✅ Defects: No bugs, logic errors, or security vulnerabilities introduced. This is a straightforward dependency version bump for a security linting tool.

Testing ⚠️

⚠️ Unit tests for new functions: N/A - No new functions added.
⚠️ Integration tests for new endpoints: N/A - No new endpoints.
⚠️ Edge cases covered: N/A - Dependency update.
⚠️ Test coverage > 80%: Cannot verify from diff alone, but this change should not affect test coverage. Recommendation: Ensure that the CI pipeline runs successfully with the new bandit version to verify no new security issues are flagged.

Documentation ⚠️

⚠️ Readme updated if needed: Not applicable for internal dependency update.
⚠️ API docs updated: Not applicable.
⚠️ Inline comments for complex logic: Not applicable.
❌ CHANGELOG.md updated: No CHANGELOG.md update visible in the diff. Action Required: If this project maintains a CHANGELOG, it should document this dependency update (e.g., "Updated bandit from 1.8.6 to 1.9.2 for improved security linting").
✅ Markdown formatting: No markdown changes in this PR.

Security ✅

✅ No hardcoded credentials: None present.
✅ Input validation implemented: N/A - Dependency update.
✅ Proper error handling: N/A - Dependency update.
✅ No sensitive data in logs: N/A - Dependency update.
✅ No license files or AQAAAD strings: None detected in the diff.

Recommendations

CHANGELOG.md: Consider adding an entry documenting this dependency update in pyproject.toml:78 if your project maintains a changelog.
Version Jump Context: The update from 1.8.6 to 1.9.2 is a minor version bump. Review the bandit release notes to understand what changes were introduced (new security checks, bug fixes, etc.) to ensure compatibility with your project.
CI/CD Verification: Ensure your CI pipeline runs successfully with this update, as newer versions of bandit may flag additional security issues that weren't caught by 1.8.6.

Overall Assessment: ✅ APPROVED with Minor Suggestions

This is a clean, straightforward dependency update for a security linting tool. The only improvement would be documenting the change in CHANGELOG.md if applicable to your project's practices.

Automated code review analyzing defects and coding standards

github-actions · 2026-01-06T14:15:29Z

🤖 Claude Code Review

I'll review this pull request diff immediately against the provided checklist.

Code Review Analysis

Code Quality

✅ Code follows style guide: The change is a single dependency version bump in pyproject.toml, which follows standard dependency management practices.

✅ No commented-out code: No commented code present.

✅ Meaningful variable names: N/A - This is a dependency version update, no variables are involved.

✅ DRY principle followed: N/A - No code duplication concerns in a dependency update.

✅ Identify Defects: No bugs, logic errors, or security vulnerabilities introduced. This is a security-focused dependency update (bandit is a security linting tool), upgrading from version 1.8.6 to 1.9.2.

✅ Project memory configuration: Checked for ./.claude/CLAUDE.md - this is a straightforward dependency update that doesn't conflict with any project-specific conventions.

Testing

⚠️ Unit tests for new functions: N/A - No new functions added, but dependency changes should ideally be validated by running the existing test suite to ensure compatibility.

⚠️ Integration tests for new endpoints: N/A - No new endpoints.

⚠️ Edge cases covered: N/A - No new logic to test.

⚠️ Test coverage > 80%: Cannot verify from this diff alone, but this change shouldn't affect coverage.

Recommendation: Ensure CI pipeline validates that all existing tests pass with the updated bandit version.

Documentation

✅ Readme updated if needed: N/A - A dependency version bump doesn't typically require README updates unless it affects user-facing installation instructions.

✅ API docs updated: N/A - No API changes.

✅ Inline comments for complex logic: N/A - No code logic changes.

❌ CHANGELOG.md updated: The CHANGELOG.md should document this dependency update, especially since bandit is a security tool and this update spans from 1.8.6 to 1.9.2 (which may include security fixes).

✅ Markdown formatting: N/A - No markdown files modified in this diff.

Security

✅ No hardcoded credentials: None present.

✅ Input validation implemented: N/A - No new input handling.

✅ Proper error handling: N/A - No code logic changes.

✅ No sensitive data in logs: N/A - No logging code changed.

✅ No license files (.lic) or AQAAAD strings: No license files or suspicious strings detected in the diff.

Summary

Overall Assessment: ✅ APPROVED with minor recommendations

This is a clean dependency update upgrading the bandit security linting tool from version 1.8.6 to 1.9.2 in pyproject.toml:78.

Required Actions:

Update CHANGELOG.md to document this bandit version bump (security tool updates should be tracked)

Recommended Actions:

Verify CI tests pass with the new bandit version
Review bandit 1.9.2 release notes for any new security checks that may flag existing code

File Modified: pyproject.toml:78

This is a low-risk change that improves the project's security tooling. The dependency update appears to be part of automated dependency maintenance (likely Dependabot based on git history).

Automated code review analyzing defects and coding standards

github-actions · 2026-01-06T14:39:55Z

🤖 Claude Code Review

Code Review Analysis

Executive Summary

This is a dependency update PR that bumps the bandit package from version 1.8.6 to 1.9.2. The change is minimal and low-risk.

Detailed Review

Code Quality

✅ Code follows style guide - N/A for dependency updates, but formatting is correct

✅ No commented-out code - None present

✅ Meaningful variable names - N/A for this change

✅ DRY principle followed - N/A for this change

✅ Identify Defects - No defects identified. This is a straightforward dependency version bump in the pyproject.toml:78. Bandit 1.9.2 is a security linting tool update, which is generally beneficial.

⚠️ Project memory configuration - No .claude/CLAUDE.md file found to evaluate against

Testing

⚠️ Unit tests for new functions - N/A for dependency updates, but recommend verifying:

That existing tests still pass with the new bandit version
That the linting phase in CI passes
That no new security warnings are introduced

⚠️ Integration tests - N/A for this change

⚠️ Edge cases covered - N/A for this change

⚠️ Test coverage > 80% - Cannot determine from diff; this change should not affect coverage

Documentation

✅ Readme updated if needed - No README updates needed for internal dev dependency bumps

✅ API docs updated - N/A; bandit is a dev dependency

✅ Inline comments for complex logic - N/A for this change

⚠️ CHANGELOG.md updated - Not visible in this diff. For a dev dependency update, CHANGELOG entry may not be required, but should be considered if this is project policy.

✅ Markdown formatting - N/A; no markdown files modified

Security

✅ No hardcoded credentials - None present

✅ Input validation - N/A for this change

✅ Proper error handling - N/A for this change

✅ No sensitive data in logs - N/A for this change

✅ No license files or AQAAAD strings - None detected in this diff

Recommendations

Verify CI passes - Ensure all linting and testing pipelines pass with bandit 1.9.2
Check for breaking changes - Review bandit's release notes between 1.8.6 and 1.9.2 to ensure no breaking changes affect your project's security linting configuration
Dependency compatibility - Verify that bandit 1.9.2 is compatible with your Python version constraints

Overall Assessment

✅ APPROVED - This is a clean, low-risk dependency update that improves security tooling. The change is properly scoped to the lint dependencies and follows standard dependency management practices in pyproject.toml:78.

Risk Level: Low
Recommendation: Approve after CI validation

Automated code review analyzing defects and coding standards

github-actions · 2026-01-07T14:14:57Z

🤖 Claude Code Review

❌ CHANGELOG.md updated - pyproject.toml:78 - The CHANGELOG.md does not have an entry in the [Unreleased] section for this bandit dependency update. While dependency updates are sometimes considered maintenance items, given the project's detailed changelog practice (including minor dependency updates), this should be documented. Recommend adding an entry like:

## [Unreleased]

### Changed

- Updated bandit from 1.8.6 to 1.9.2

✅ Markdown formatting - The diff doesn't modify any markdown files.

Security

✅ No hardcoded credentials - N/A for dependency updates.

✅ Input validation implemented - N/A for dependency updates.

✅ Proper error handling - N/A for dependency updates.

✅ No sensitive data in logs - N/A for dependency updates.

✅ No license files checked in - No .lic files or AQAAAD strings in the diff.

Summary

Overall Assessment: ✅ APPROVED with Minor Recommendation

This is a straightforward and beneficial dependency update upgrading the bandit security linting tool from 1.8.6 to 1.9.2. The change is low-risk and likely includes security improvements and bug fixes.

Issues Found:

Minor: CHANGELOG.md should be updated to reflect this dependency change in the [Unreleased] section (pyproject.toml:78)

Recommendations:

Verify that CI/CD pipelines pass with the new bandit version
Ensure bandit 1.9.2 is compatible with all Python versions supported by this project
Update CHANGELOG.md as noted above

The code change itself is clean and properly formatted. No security concerns or code quality issues identified.

Automated code review analyzing defects and coding standards

github-actions · 2026-01-08T14:11:13Z

🤖 Claude Code Review

Code Review Analysis

Summary

This PR updates the bandit dependency from version 1.8.6 to 1.9.2 in the project's lint dependencies.

Detailed Review

Code Quality

✅ Code follows style guide - The change is a simple dependency version update in TOML format, which follows standard pyproject.toml conventions.

✅ No commented-out code - No commented code present.

✅ Meaningful variable names - N/A for dependency updates.

✅ DRY principle followed - N/A for dependency updates.

✅ Identify Defects - No defects found. This is a straightforward dependency version bump for a security linting tool. The version update (1.8.6 → 1.9.2) appears to be a minor version update, likely containing bug fixes and potentially new security checks.

✅ Project memory configuration - Checked ./.claude/CLAUDE.md - not applicable to this dependency update.

Testing

⚠️ Unit tests for new functions - N/A for dependency updates, but consider:

This change updates a linting tool, not application code
Best practice would be to verify the project still builds and existing lint checks pass
No test changes are included, which is expected for a dependency update

⚠️ Integration tests - N/A for dependency updates.

⚠️ Edge cases covered - N/A for dependency updates.

❓ Test coverage > 80% - Cannot verify from diff alone. This dependency update shouldn't affect test coverage, but the updated bandit version may introduce new security checks that could fail if there are security issues in the codebase.

Documentation

⚠️ Readme updated if needed - N/A - Dependency version updates typically don't require README updates unless there are breaking changes or new setup requirements.

✅ API docs updated - N/A for dependency updates.

✅ Inline comments - N/A for dependency updates.

❌ CHANGELOG.md updated - pyproject.toml:78 - The CHANGELOG.md should be updated to document this dependency version bump, especially since bandit is a security tool and version updates may introduce new security checks or fix bugs in existing ones.

✅ Markdown formatting - N/A - no markdown files modified.

Security

✅ No hardcoded credentials - No credentials in this change.

✅ Input validation - N/A for dependency updates.

✅ Proper error handling - N/A for dependency updates.

✅ No sensitive data in logs - N/A for dependency updates.

✅ No license files (.lic) or AQAAAD strings - No license files or sensitive strings present.

Recommendations

Update CHANGELOG.md (Required) - Document this dependency update: Bump bandit from 1.8.6 to 1.9.2
Verification (Recommended) - Before merging, ensure:
- The project builds successfully with the new version
- All existing lint checks pass with bandit==1.9.2
- No new security warnings are introduced (or if they are, they should be addressed)
Review Release Notes (Recommended) - Check bandit's release notes between 1.8.6 and 1.9.2 for any breaking changes or new checks that might affect the codebase.

Overall Assessment

Status: Needs Minor Update

This is a routine dependency update that improves the project's security tooling. The only required change is updating the CHANGELOG.md to document this update. Once that's addressed, this PR should be safe to merge after verifying the build and lint checks pass.

Automated code review analyzing defects and coding standards

github-actions · 2026-01-08T16:51:45Z

🤖 Claude Code Review

⚠️ No file changes detected - skipping code review.

This PR appears to contain only metadata changes (labels, description, etc.).

dependabot Bot added dependencies Pull requests that update a dependency file python python programming languagae labels Jan 5, 2026

dependabot Bot requested a review from a team as a code owner January 5, 2026 22:14

dependabot Bot added python python programming languagae dependencies Pull requests that update a dependency file labels Jan 5, 2026

Merge branch 'main' into dependabot/pip/bandit-1.9.2

3e8ef23

docktermj self-assigned this Jan 6, 2026

docktermj approved these changes Jan 6, 2026

View reviewed changes

Merge branch 'main' into dependabot/pip/bandit-1.9.2

87b6e80

docktermj enabled auto-merge (squash) January 6, 2026 14:39

Merge branch 'main' into dependabot/pip/bandit-1.9.2

8c6b08a

Merge branch 'main' into dependabot/pip/bandit-1.9.2

e2070b2

Merge main

fca1c0b

docktermj merged commit 8939abe into main Jan 8, 2026
38 checks passed

docktermj deleted the dependabot/pip/bandit-1.9.2 branch January 8, 2026 16:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump bandit from 1.8.6 to 1.9.2#311

Bump bandit from 1.8.6 to 1.9.2#311
docktermj merged 6 commits into
mainfrom
dependabot/pip/bandit-1.9.2

dependabot Bot commented on behalf of github Jan 5, 2026 •

edited by github-actions Bot

Loading

Uh oh!

github-actions Bot commented Jan 5, 2026

Uh oh!

github-actions Bot commented Jan 6, 2026

Uh oh!

github-actions Bot commented Jan 6, 2026

Uh oh!

github-actions Bot commented Jan 7, 2026

Uh oh!

github-actions Bot commented Jan 8, 2026

Uh oh!

github-actions Bot commented Jan 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Jan 5, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1.9.2

What's Changed

1.9.1

What's Changed

1.9.0

What's Changed

New Contributors

Uh oh!

github-actions Bot commented Jan 5, 2026

🤖 Claude Code Review

Code Review Analysis

Summary

Detailed Review

Code Quality ✅

Testing ⚠️

Documentation ⚠️

Security ✅

Recommendations

Overall Assessment: ✅ APPROVED with Minor Suggestions

This is a clean, straightforward dependency update for a security linting tool. The only improvement would be documenting the change in CHANGELOG.md if applicable to your project's practices.

Uh oh!

github-actions Bot commented Jan 6, 2026

🤖 Claude Code Review

Code Review Analysis

Code Quality

Testing

Documentation

Security

Summary

Required Actions:

Recommended Actions:

This is a low-risk change that improves the project's security tooling. The dependency update appears to be part of automated dependency maintenance (likely Dependabot based on git history).

Uh oh!

github-actions Bot commented Jan 6, 2026

🤖 Claude Code Review

Code Review Analysis

Executive Summary

Detailed Review

Code Quality

Testing

Documentation

Security

Recommendations

Overall Assessment

Risk Level: Low Recommendation: Approve after CI validation

Uh oh!

github-actions Bot commented Jan 7, 2026

🤖 Claude Code Review

Security

Summary

Issues Found:

Recommendations:

The code change itself is clean and properly formatted. No security concerns or code quality issues identified.

Uh oh!

github-actions Bot commented Jan 8, 2026

🤖 Claude Code Review

Code Review Analysis

Summary

Detailed Review

Code Quality

Testing

Documentation

Security

Recommendations

Overall Assessment

This is a routine dependency update that improves the project's security tooling. The only required change is updating the CHANGELOG.md to document this update. Once that's addressed, this PR should be safe to merge after verifying the build and lint checks pass.

Uh oh!

github-actions Bot commented Jan 8, 2026

🤖 Claude Code Review

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

dependabot Bot commented on behalf of github Jan 5, 2026 •

edited by github-actions Bot

Loading

Risk Level: Low
Recommendation: Approve after CI validation