Bump bandit from 1.8.6 to 1.9.2

[dependabot]

Bumps bandit from 1.8.6 to 1.9.2.

Release notes

Sourced from bandit's releases.

1.9.2

What's Changed

• Argparse Python 3.14 enhancements by @​ericwb in PyCQA/bandit#1331
• Check whether Constant value is str by @​ericwb in PyCQA/bandit#1333

Full Changelog: PyCQA/bandit@1.9.1...1.9.2

1.9.1

What's Changed

• More Python version related fixes by @​ericwb in PyCQA/bandit#1327

Full Changelog: PyCQA/bandit@1.9.0...1.9.1

1.9.0

What's Changed

• Add instructions for Maintainers to create/publish a release by @​ericwb in PyCQA/bandit#1275
• Bump sigstore/cosign-installer from 3.9.1 to 3.9.2 by @​dependabot[bot] in PyCQA/bandit#1289
• Bump docker/login-action from 3.4.0 to 3.5.0 by @​dependabot[bot] in PyCQA/bandit#1290
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in PyCQA/bandit#1291
• Bump actions/checkout from 4 to 5 by @​dependabot[bot] in PyCQA/bandit#1292
• Replace deprecated datetime.datetime.utcnow() by @​purplezimmermann in PyCQA/bandit#1295
• Bump actions/setup-python from 5 to 6 by @​dependabot[bot] in PyCQA/bandit#1296
• Bump sigstore/cosign-installer from 3.9.2 to 3.10.0 by @​dependabot[bot] in PyCQA/bandit#1298
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in PyCQA/bandit#1303
• Fix typos by @​Shortfinga in PyCQA/bandit#1305
• Bump docker/login-action from 3.5.0 to 3.6.0 by @​dependabot[bot] in PyCQA/bandit#1306
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in PyCQA/bandit#1315
• Bump sigstore/cosign-installer from 3.10.0 to 4.0.0 by @​dependabot[bot] in PyCQA/bandit#1317
• Support of Python 3.14 by @​ericwb in PyCQA/bandit#1323
• Drop support of end-of-life Python 3.9 by @​ericwb in PyCQA/bandit#1325
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in PyCQA/bandit#1324

New Contributors

• @​purplezimmermann made their first contribution in PyCQA/bandit#1295
• @​Shortfinga made their first contribution in PyCQA/bandit#1305

Full Changelog: PyCQA/bandit@1.8.6...1.9.0

Commits

• ea0d187 Check whether Constant value is str (#1333)
• 8bf7594 Argparse Python 3.14 enhancements (#1331)
• a255dfa More Python version related fixes (#1327)
• 3f07bb0 [pre-commit.ci] pre-commit autoupdate (#1324)
• c8c3fb8 Drop support of end-of-life Python 3.9 (#1325)
• 5c30350 Support of Python 3.14 (#1323)
• e1ffdf6 Bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#1317)
• 176d4ca [pre-commit.ci] pre-commit autoupdate (#1315)
• 2fc3e9c Bump docker/login-action from 3.5.0 to 3.6.0 (#1306)
• 6a68546 Fix typos (#1305)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Resolves #1333
Resolves #1331
Resolves #1327
Resolves #1324
Resolves #1325
Resolves #1323
Resolves #1317
Resolves #1315
Resolves #1306
Resolves #1305
Resolves PyCQA/bandit#1331
Resolves PyCQA/bandit#1333
Resolves PyCQA/bandit#1327
Resolves PyCQA/bandit#1275
Resolves PyCQA/bandit#1289
Resolves PyCQA/bandit#1290
Resolves PyCQA/bandit#1291
Resolves PyCQA/bandit#1292
Resolves PyCQA/bandit#1295
Resolves PyCQA/bandit#1296
Resolves PyCQA/bandit#1298
Resolves PyCQA/bandit#1303
Resolves PyCQA/bandit#1305
Resolves PyCQA/bandit#1306
Resolves PyCQA/bandit#1315
Resolves PyCQA/bandit#1317
Resolves PyCQA/bandit#1323
Resolves PyCQA/bandit#1325
Resolves PyCQA/bandit#1324

[github-actions]

🤖 Claude Code Review

Code Review Analysis

I'll analyze this pull request against the checklist. This is a simple dependency version bump for the bandit security linting tool from 1.8.6 to 1.9.2.

Review Results

Code Quality

✅ Code follows style guide - This is a dependency version update in a TOML file, no code style issues apply.

✅ No commented-out code - No code comments present.

✅ Meaningful variable names - N/A for dependency declarations.

✅ DRY principle followed - N/A for dependency updates.

✅ Identify Defects - No defects identified. This is a straightforward security tool version bump. Bandit 1.9.2 is a legitimate release that includes bug fixes and improvements over 1.8.6.

✅ Project memory configuration - The change is appropriate for the project configuration as defined in .claude/CLAUDE.md. The project uses bandit for security checks (with B101 skipped for assert usage), and this update maintains that capability.

Testing

✅ Unit tests for new functions - N/A, no new functionality added.

✅ Integration tests for new endpoints - N/A, no new endpoints.

✅ Edge cases covered - N/A, dependency update only.

⚠️ Test coverage > 80% - Cannot verify from this diff, but the change shouldn't affect coverage. The updated bandit version should be compatible with existing tests. Recommendation: Verify that make lint passes with the new bandit version.

Documentation

✅ README updated if needed - No README update needed for internal development dependency.

✅ API docs updated - N/A, no API changes.

✅ Inline comments for complex logic - N/A.

⚠️ CHANGELOG.md updated - Not visible in this diff. For a minor security tool update, this may not require a CHANGELOG entry since it's a development dependency, but consider documenting if this fixes specific security warnings. Recommendation: Check if bandit 1.9.2 addresses any specific issues that should be noted.

✅ Markdown formatting - N/A, no markdown files modified.

Security

✅ No hardcoded credentials - None present.

✅ Input validation implemented - N/A.

✅ Proper error handling - N/A.

✅ No sensitive data in logs - N/A.

✅ No license files checked in - No .lic files or AQAAAD strings in this change.

Summary

Overall Assessment: ✅ APPROVED

This is a clean dependency update for the bandit security linting tool. The change is low-risk and improves the project's security tooling.

File: pyproject.toml:72

Recommendations:

1. Verify make lint and make bandit pass successfully with the new version
2. Check if any new bandit warnings are introduced that need addressing or suppression
3. Consider if CHANGELOG.md should note this security tool update (optional for dev dependencies)

No blocking issues identified.

Automated code review analyzing defects and coding standards

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.

[github-actions]

🤖 Claude Code Review

Code Review for PR: Bump bandit from 1.8.6 to 1.9.2

I'll analyze this pull request against the review checklist.

Review Analysis

Code Quality ✅

• Style Guide Compliance: ✅ Change follows the project's Python style conventions
• No Commented-out Code: ✅ N/A - No code commented out
• Meaningful Variable Names: ✅ N/A - No new variables introduced
• DRY Principle: ✅ N/A - Dependency version update only
• Defects/Bugs: ✅ No defects identified. This is a security tool version bump from 1.8.6 to 1.9.2, which should include bug fixes and security improvements
• Project Memory Considerations: ✅ The .claude/CLAUDE.md mentions bandit in the linting section. This change aligns with the project's documented use of bandit for security checks

File: pyproject.toml:72

Testing ⚠️

• Unit Tests: ⚠️ No new tests needed for dependency updates, but the change should be validated by:
  • Running make lint to ensure bandit 1.9.2 doesn't introduce new warnings/errors
  • Verifying CI passes with the new version
• Integration Tests: ✅ N/A - Dependency version bump
• Edge Cases: ✅ N/A
• Test Coverage: ⚠️ Cannot determine from diff - should verify existing coverage remains above 80% after dependency update

Recommendation: Ensure CI/CD pipeline validates that make lint and make bandit still pass with version 1.9.2.

Documentation ⚠️

• README Updates: ✅ N/A - No user-facing changes
• API Docs: ✅ N/A - Internal dependency only
• Inline Comments: ✅ N/A
• CHANGELOG.md: ❌ Missing - Dependency updates should be documented in CHANGELOG.md for transparency about what changed between releases
• Markdown Formatting: N/A - No markdown files modified

File: CHANGELOG.md (should be updated)

Security ✅

• No Hardcoded Credentials: ✅ None present
• Input Validation: ✅ N/A
• Error Handling: ✅ N/A
• Sensitive Data in Logs: ✅ N/A
• License Files (.lic) or AQAAAD strings: ✅ None present

Security Note: This change improves security posture by upgrading bandit, which is a security linting tool. Bandit 1.9.2 likely includes improved security checks and bug fixes.

---

Summary

✅ Approved with Minor Recommendations

This is a straightforward and beneficial dependency update that improves the project's security tooling.

Required Actions:

• ❌ Add entry to CHANGELOG.md documenting the bandit version bump

Recommended Actions:

• Verify make lint passes locally with bandit 1.9.2
• Confirm no new security warnings are introduced by the updated version

Overall Assessment: This is a low-risk, positive change that keeps security tooling current. The only missing element is changelog documentation.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

Code Review - Bandit Version Bump

Executive Summary

This is a straightforward dependency version bump from bandit==1.8.6 to bandit==1.9.2 for security linting purposes. The change is minimal, low-risk, and appears to be part of routine dependency maintenance.

---

Detailed Review Against Checklist

Code Quality

✅ Code follows style guide

• This is a dependency version change in pyproject.toml, not code. No style violations.

✅ No commented-out code

• N/A - No code changes.

✅ Meaningful variable names

• N/A - No code changes.

✅ DRY principle followed

• N/A - No code changes.

✅ Identify Defects

• No bugs, logic errors, or security vulnerabilities introduced. This is an upgrade to a security linting tool, which should improve security scanning capabilities.

✅ Project memory configuration consideration

• The .claude/CLAUDE.md indicates this project uses bandit for security checks with B101 (assert usage) skipped. This configuration remains intact in pyproject.toml:88. The version bump does not conflict with project guidelines.

Testing

❌ Unit tests for new functions

• Issue: No tests verify that the new bandit version works correctly with the project's existing configuration (line 72).
• Recommendation: While not strictly necessary for a version bump, it would be prudent to run make lint or make bandit to confirm the new version doesn't introduce breaking changes or new warnings.

✅ Integration tests for new endpoints

• N/A - No new endpoints.

✅ Edge cases covered

• N/A - No functional code changes.

⚠️ Test coverage > 80%

• N/A - No code changes that affect coverage. However, should verify that bandit still runs successfully.

Documentation

❌ CHANGELOG.md updated

• Issue: The CHANGELOG.md has not been updated to reflect this dependency bump. While minor, dependency updates should be documented for transparency.
• Location: CHANGELOG.md:8-10 (Unreleased section)
• Recommendation: Add entry under "Changed in Unreleased" section:

  - Updated bandit from 1.8.6 to 1.9.2

✅ Readme updated if needed

• N/A - This change doesn't affect user-facing documentation.

✅ API docs updated

• N/A - No API changes.

✅ Inline comments for complex logic

• N/A - No code changes.

✅ Markdown files follow CommonMark specification

• Existing CHANGELOG.md appears to follow CommonMark. If updated, ensure formatting is preserved.

Security

✅ No hardcoded credentials

• N/A - No credentials present.

✅ Input validation implemented

• N/A - No code changes.

✅ Proper error handling

• N/A - No code changes.

✅ No sensitive data in logs

• N/A - No code changes.

✅ No license files (.lic) or AQAAAD strings checked in

• No license files detected in the diff.

---

Summary Recommendations

Required Changes:

1. Update CHANGELOG.md (CHANGELOG.md:10) - Add the bandit version bump to the "Unreleased" section

Recommended Actions:

1. Verify compatibility - Run make lint or make bandit to ensure the new version works with existing configuration
2. Check for breaking changes - Review bandit 1.9.2 release notes for any breaking changes between 1.8.6 and 1.9.2

Overall Assessment: ✅ APPROVE with minor documentation update required

This is a routine security dependency update that poses minimal risk. The only missing piece is CHANGELOG documentation. Once that's addressed, this PR is ready to merge.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

Code Review: Bandit Version Bump (1.8.6 → 1.9.2)

Summary

This PR updates the bandit security linter from version 1.8.6 to 1.9.2 in pyproject.toml:72. This is a straightforward dependency version bump.

---

Review Checklist

Code Quality

✅ Code follows style guide

• The change follows the project's dependency management pattern in pyproject.toml
• Formatting is consistent with existing entries

✅ No commented-out code

• No commented code present in this diff

✅ Meaningful variable names

• N/A - This is a configuration change, not code

✅ DRY principle followed

• N/A - Single dependency version update

✅ Defects identification

• No bugs, logic errors, or security vulnerabilities introduced
• This is a security tool upgrade, which should improve security scanning capabilities

✅ Project memory configuration (./.claude/CLAUDE.md)

• The CLAUDE.md file mentions "bandit for security checks (B101 skipped for assert usage)" at line 114
• The change is consistent with the project's use of bandit as a linting tool
• The configuration at pyproject.toml:87-88 ([tool.bandit] with skips = ["B101"]) remains unchanged and compatible

---

Testing

⚠️ Unit tests for new functions

• N/A for dependency update, but should verify bandit still runs successfully

⚠️ Integration tests for new endpoints

• N/A for this change

⚠️ Edge cases covered

• N/A for this change

⚠️ Test coverage > 80%

• N/A - This change doesn't affect code coverage
• Recommendation: Run make lint or make bandit to verify the new version works correctly with the existing codebase and B101 skip configuration

---

Documentation

✅ Readme updated if needed

• No README update needed for internal dependency version bump

✅ API docs updated

• N/A - No API changes

✅ Inline comments for complex logic

• N/A - Configuration change only

❌ CHANGELOG.md updated

• File: CHANGELOG.md
• Issue: The CHANGELOG.md should document this dependency update
• Recommendation: Add an entry under an "Unreleased" or version section noting the bandit upgrade from 1.8.6 to 1.9.2

✅ Markdown files follow CommonMark

• N/A - No markdown files modified in this diff

---

Security

✅ No hardcoded credentials

• None present

✅ Input validation implemented

• N/A for this change

✅ Proper error handling

• N/A for this change

✅ No sensitive data in logs

• N/A for this change

✅ License files (.lic) / AQAAAD strings

• No license files or suspicious strings in this diff

---

Overall Assessment

Status: ✅ APPROVED with minor recommendations

This is a clean dependency version bump that upgrades the bandit security linting tool. The change is minimal and follows the project's existing patterns.

Required Actions

1. ❌ Update CHANGELOG.md to document this dependency upgrade

Recommended Actions

1. ⚠️ Verify compatibility: Run make lint or make bandit to ensure bandit 1.9.2 works correctly with the existing configuration (especially the B101 skip for assert statements)
2. ⚠️ Check for new findings: The newer version may detect additional security issues - review any new warnings

Notes

• Bandit 1.9.2 was released to address security improvements and bug fixes
• The existing [tool.bandit] configuration with skips = ["B101"] should remain compatible
• This aligns with the project's commitment to security as mentioned in CLAUDE.md

---

Automated code review analyzing defects and coding standards