Phantasm
|
770d827b50
|
Sec: Bump bandit to version 1.12.5
Fixes:
- EEF-CVE-2026-74836 (HIGH)
aka: CVE-2026-74836, GHSA-xj8g-532w-jv94
HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-74836
- EEF-CVE-2026-75484 (MEDIUM)
aka: CVE-2026-75484, GHSA-x3gh-xhj4-3vq8
HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-75484
|
2026-09-08 21:28:37 +02:00 |
|