Skip to content

build(deps): bump the pip group across 3 directories with 12 updates - #3914

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/integrations/bbot/pip-a5731659f6
Open

build(deps): bump the pip group across 3 directories with 12 updates#3914
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/integrations/bbot/pip-a5731659f6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip group with 1 update in the /integrations/bbot directory: bbot.
Bumps the pip group with 1 update in the /integrations/malware_tools_analyzers/requirements directory: flask.
Bumps the pip group with 10 updates in the /requirements directory:

Package From To
pycti 6.8.8 6.9.7
authlib 1.6.5 1.6.12
daphne 4.2.1 4.2.2
gitpython 3.1.41 3.1.58
lief 0.15.1 0.17.2
pillow 11.0.0 12.3.0
pyzipper 0.3.6 0.4.0
langchain 0.3.30 1.3.9
deepdiff 8.6.1 8.6.2
lxml 6.0.2 6.1.0

Updates bbot from 2.7.2 to 3.0.0

Release notes

Sourced from bbot's releases.

3.0.0

BBOT 3.0.0

[!WARNING] Upgrading from 2.x is not drop-in. The CLI, flags, preset syntax, event API, config keys, and module set all changed in backwards-incompatible ways. Read the 2.x to 3.0 migration guide before upgrading. The changes most likely to bite:

  • -s now means --seeds, not --silent (silent moved to -S). A script passing -s for quiet output will now add a seed instead, with no error.
  • --whitelist was retired: -t/--targets now defines scope, and -s/--seeds drives the scan.
  • --allow-deadly was removed, and several flags were renamed (e.g. noisy to loud).
  • Module options are now pydantic-validated; the legacy options dict hard-fails.
  • Some event types, event attributes, and config keys were renamed or removed.

Highlights

  • New HTTP engine (blasthttp): in-process, rate-limited HTTP replacing the httpx subprocess (#2992, #3021)
  • New DNS engine (BlastDNS) (#3042)
  • Pydantic config + preset validation: typos and type errors are caught before a scan starts (#2486, #3058)
  • Scope rework: clean split between target (scope) and seeds (drivers); --whitelist retired (#2789)
  • Findings and Vulnerabilities unified, with Severity and Confidence (#2436, #2740)
  • asndb: faster ASN enrichment, plus ASNs usable as scan targets (#2957, #2741)
  • Lightfuzz overhaul: new SSRF and ESI submodules, far fewer false positives (#2967)
  • Major performance work: memory and CPU optimizations, bounded DNS caches, HTTP body stripping, string interning (#2953, #3085, #3088)
  • Preset naming / tag standardization across flags, presets, and event tags (#2986)
  • New modules: MongoDB / Elastic / Kafka / RabbitMQ / ZeroMQ / NATS outputs, legba, trajan, virtualhost, waf_bypass, dnsspf, Hetzner bucket
  • Modules removed: wappalyzer, smuggler, digitorus, sitedossier, passivetotal, wpscan

Core & Packaging

  • Packaging moved from Poetry to uv + hatchling, and supported Python is now 3.10 - 3.14 (#2900, #2731).
  • Config values and presets are validated with pydantic before a scan runs, so typos and wrong types fail fast instead of silently doing nothing. The legacy per-module options dict is no longer accepted (#2486, #3058, #3119).
  • Malformed YAML in a config or preset now produces a readable error instead of a stack trace (#3159).
  • New --reset-config / --reset-secrets to regenerate stale config files (#3240).

Scope & Targeting

  • Scope was reworked around a target/seeds split: -t/--targets defines scope, -s/--seeds supplies the starting events, --whitelist is gone, and --strict-scope now means "this exact host only" (#2789).
  • ASNs can be used directly as scan targets (#2741).
  • Files can be passed as targets, seeds, or blacklist entries inside presets, and target lists may contain comments (#2996, #3031).

HTTP & Web

  • All web traffic now runs in-process through one shared, rate-limited client (blasthttp) instead of a separate httpx subprocess (#2992, #3021).
  • HTTP wildcard/catch-all host detection cuts false positives on servers that answer every request (#3164).
  • 429 Too Many Requests responses are now honored for rate limiting (#3145).
  • HTTP timeout settings were consolidated into one place (#3222).
  • SSL verification was split so BBOT verifies its own infrastructure calls by default while still not verifying untrusted target traffic (#3186).

DNS

... (truncated)

Changelog

Sourced from bbot's changelog.

2.8.6 - Jun 16, 2026

2.8.5 - Jun 16, 2026

2.8.4 - Mar 17, 2026

2.8.3 - Feb 26, 2026

2.8.2 - Feb 12, 2026

2.8.1 - Jan 30, 2026

2.8.0 - Jan 20, 2026

Commits

Updates flask from 3.1.1 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

  • stream_with_context does not fail inside async views. #5774
  • When using follow_redirects in the test client, the final state of session is correct. #5786
  • Relax type hint for passing bytes IO to send_file. #5776
Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

  • stream_with_context does not fail inside async views. :issue:5774
  • When using follow_redirects in the test client, the final state of session is correct. :issue:5786
  • Relax type hint for passing bytes IO to send_file. :issue:5776
Commits
  • 22d9247 release version 3.1.3
  • 089cb86 Merge commit from fork
  • c17f379 request context tracks session access
  • 27be933 start version 3.1.3
  • 4e652d3 Abort if the instance folder cannot be created (#5903)
  • 3d03098 Abort if the instance folder cannot be created
  • 407eb76 document using gevent for async (#5900)
  • ac5664d document using gevent for async
  • 4f79d5b Increase required flit_core version to 3.11 (#5865)
  • fe3b215 Increase required flit_core version to 3.11
  • Additional commits viewable in compare view

Updates pycti from 6.8.8 to 6.9.7

Release notes

Sourced from pycti's releases.

Version 6.9.7

Enhancements:

  • #13990 Implement new inference rules
  • #13975 Support multiple files upload at creation of entities
  • #13971 [client] Upload file at creation of entities instead of after the creation
  • #13944 [client] Add support of file download during import process
  • #11383 Create inference rule on attribution
  • #10505 [Rules Engine] If Report contains IP, and IP belongs to ASN then Report contains ASN

Bug Fixes:

  • #13940 Unable to add personal notifiers
  • #13933 Redirect the learn more of the OCTI demo banner to the Hub public trial page
  • #13901 Users add relations in orga admin context
  • #13897 Status renaming is not taken into account
  • #13888 Form Intakes cannot be launched when using "Toggle" field type on Malware is_family
  • #13818 AI Insights returns text in Markdown format instead of HTML.
  • #13792 Campaigns do not display Security Coverage Icons if there is an Associated Security Coverage
  • #13753 Simple Mailer {"variableName":"escape"} Error
  • #13624 Channel Entity Does Not Display Channel Type in GUI
  • #13610 Domain import fails when using “domain name” in CSV Mapper
  • #13058 Generated PDFs of RSS Feed For The Record Are Not Properly Created
  • #12445 "Interval" for the bookmark widget serves no purpose
  • #11800 GraphQL internal server error

Pull Requests:

Full Changelog: OpenCTI-Platform/opencti@6.9.6...6.9.7

... (truncated)

Commits
  • 97ca75e [backend/worker] Release 6.9.7
  • 9485636 [backend] Implement new inference rules (#13990, #11383, #10505)
  • e2a540b [backend/client] Support multiple files upload at creation of entities (#13975)
  • 2cb4539 [backend] Allow escape function in safeEjs for Simple Mailer templates (#13753)
  • b21a404 [client/backend/frontend] Upload file at creation of entities instead of afte...
  • c69df32 [frontend] Remove unused Interval parameter from bookmark widget configuratio...
  • 2db4102 [frontend] Fix Form Intakes Toggle field ignoring defaultValue on initializat...
  • d9dab7c [backend] Add missing securityCoverage resolver for Campaign entities (#13970)
  • 0412c91 [backend] Fix AI Insights Containers Digest returning Markdown instead of HTM...
  • a384a2f [deps] Update dependency uuid to v13 (#12783)
  • Additional commits viewable in compare view

Updates authlib from 1.6.5 to 1.6.12

Release notes

Sourced from authlib's releases.

v1.6.12

v1.6.11

Full Changelog: authlib/authlib@v1.6.10...v1.6.11

  • Fix CSRF issue with starlette client

v1.6.10

Full Changelog: authlib/authlib@v1.6.9...v1.6.10

  • Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

v1.6.9

Full Changelog: authlib/authlib@v1.6.8...v1.6.9

Changes in jose module

  • Not using header's jwk automatically
  • Add ES256K into default jwt algorithms
  • Remove deprecated algorithm from default registry
  • Generate random cek when cek length doesn't match

v1.6.8

Full Changelog: authlib/authlib@v1.6.7...v1.6.8

  • Add EdDSA to default jwt instance.

v1.6.7

Full Changelog: authlib/authlib@v1.6.6...v1.6.7

Set supported algorithms for the default jwt instance.

v1.6.6

What's Changed

New Contributors

Full Changelog: authlib/authlib@v1.6.5...v1.6.6

Changelog

Sourced from authlib's changelog.

Version 1.6.12

Released on may 4, 2026

  • Fix redirecting to unvalidated redirect_uri on InvalidScopeError in OpenIDImplicitGrant and OpenIDHybridGrant.

Version 1.6.11

Released on Apr 16, 2026

  • Fix CSRF vulnerability in the Starlette OAuth client when a cache is configured.

Version 1.6.10

Released on Apr 13, 2026

  • Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Version 1.6.9

Released on Mar 2, 2026

  • Not using header's jwk automatically.
  • Add ES256K into default jwt algorithms.
  • Remove deprecated algorithm from default registry.
  • Generate random cek when cek length doesn't match.

Version 1.6.8

Released on Feb 17, 2026

  • Add EdDSA to default jwt instance.

Version 1.6.7

Released on Feb 6, 2026

  • Set supported algorithms for the default jwt instance.

Version 1.6.6

... (truncated)

Commits
  • e46e515 chore: bump to 1.6.12
  • 9babc13 fix: redirecting to unvalidated redirect_uri on InvalidScopeError in OIDC grants
  • 0dc0e5b chore: bump to 1.6.11
  • aa7b8e4 Merge commit from fork
  • 401a770 fix: CSRF issue with starlette client
  • ef09aeb chore: release 1.6.10
  • 3be0846 fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError
  • 9266eaa chore: release 1.6.9
  • b9bb2b2 fix(oidc): fail close at validating c_hash and at_hash
  • 1b0a1d9 fix(jose): generate random cek when cek length doesn't match
  • Additional commits viewable in compare view

Updates daphne from 4.2.1 to 4.2.2

Changelog

Sourced from daphne's changelog.

4.2.2 (2026-06-03)

  • Fixed a denial of service vulnerability via unbounded WebSocket message sizes. Daphne previously passed no message or frame size limits to autobahn, whose defaults are unbounded. This allowed an unauthenticated client to exhaust server memory by sending a very large WebSocket messages/frames (CVE-2026-44545).

    Both limits now default to 1 MiB and can be configured via the new --websocket-max-message-size and --websocket-max-frame-size CLI flags (or the matching Server constructor arguments). Pass 0 to restore the previous unlimited behaviour.

    Thanks to ParkHyunWoo for the report.

  • Fixed a header injection vulnerability on the WebSocket upgrade path (CVE-2026-44546).

    Header values containing \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 were parsed as a single header by Twisted but split into multiple headers by autobahn during the WebSocket handshake. An attacker could exploit this parser differential to smuggle additional headers (e.g. authentication tokens, X-Forwarded-For, Origin, Daphne-Root-Path) into the ASGI scope passed to the application.

    Daphne now rejects requests carrying these bytes in any header value with a 400 Bad Request response, as required by RFC 9110 §5.5.

    Thanks to Rene Henningsen for the report.

Commits

Updates gitpython from 3.1.41 to 3.1.58

Release notes

Sourced from gitpython's releases.

Security and Fixes

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.57...3.1.58

3.1.57 - Security and Fixes

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.56...3.1.57

3.1.56 - SECURITY

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.55...3.1.56

3.1.55 - Security

What's Changed

... (truncated)

Commits
  • 30be45d prepare changelog for upcoming release
  • fc2f02c Merge pull request #2197 from Cyrus580529/shared-symlink-guard
  • b10e250 test: use the shared guard instead of local copies
  • e3e5da8 test: skip tests that need symlink privileges
  • 30d05e3 test: add a shared symlink capability guard
  • 9a8f6fe Merge pull request #2204 from gitpython-developers/security-fixes
  • f2550b6 Guard pathspec file inputs in high-level commands
  • d9ddb55 Guard unsafe git init options
  • 9b5dcaf Guard read-tree index output paths
  • 96a888f Check joined short-option values before Git execution
  • Additional commits viewable in compare view

Updates lief from 0.15.1 to 0.17.2

Release notes

Sourced from lief's releases.

0.17.2

https://lief.re/doc/stable/changelog.html#january-3rd-2026

0.17.1

See: https://lief.re/doc/stable/changelog.html#october-25th-2025

v0.17.0

v0.16.7

No release notes provided.

v0.16.6

See: https://lief.re/doc/stable/changelog.html#may-29th-2025

0.16.5

See: https://lief.re/doc/stable/changelog.html#april-19th-2025

Compared to previous releases, this release adds new pre-compiled packages for:

  • Alpine ARM64 (based on Musl)
  • Windows ARM64
  • Alpine i686/i386 (based on Musl)

0.16.4

See: https://lief.re/doc/stable/changelog.html#february-23rd-2025

0.16.3

See: https://lief.re/doc/stable/changelog.html#february-1st-2025

0.16.2

https://lief.re/doc/stable/changelog.html#january-1st-2025

0.16.1

https://lief.re/doc/stable/changelog.html#december-26th-2024

v0.16.0

https://lief.re/doc/stable/changelog.html#december-10th-2024

Commits

Updates pillow from 11.0.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Documentation

Dependencies

Testing

... (truncated)

Changelog

Sourced from pillow's changelog.

Changelog (Pillow)

11.1.0 and newer

See GitHub Releases:

Commits
  • bb1d8e8 12.3.0 version bump
  • e63fc48 Add release notes for SBOM and performance improvements (#9747)
  • 13b701b Add release notes for #9679
  • 5564ca7 List methods
  • a0920fd Speed up ImageChops operations (#9738)
  • 07e9a6c Speed up Image.filter() (#9736)
  • a94578c Speed up Image.getchannel(), Image.merge(), Image.putalpha() and `Image...
  • 53e02c4 Speed up Image.fill(), Image.linear_gradient() and `Image.radial_gradient...
  • af03747 Speed up Image.resample() (#9739)
  • 5c9ca56 Speed up alpha_composite, matrix, negative, quantize (#9740)
  • Additional commits viewable in compare view

Updates pyzipper from 0.3.6 to 0.4.0

Changelog

Sourced from pyzipper's changelog.

0.4.0 (2026-05-13)

  • Update package to use pyproject.toml
  • Fix bug where CRC32 values were not removed for small files (CVE-2026-44722). pyzipper no longer writes any CRC32 values by default, regardless of file size. The CRC32 value could be used to brute-force candidate plaintexts by computing CRC32(candidate) and comparing against the stored value. In practice, this attack is feasible today only against small or low-entropy files, as CRC32 exhaustion across a large plaintext space is computationally prohibitive on current hardware.
Commits
  • a814388 Merge commit from fork
  • 6836583 Update test to loop through all compression methods
  • 4c23f26 Update README to include information about the CRC bug
  • 9d2a95c Fix README.rst block quote
  • 43b001b Update HISTORY.rst and version
  • bf7a6bd Add SECURITY.rst
  • 85ce9a5 Update README.rst with CRC information
  • 93ce88e Remove CRC32 values from file entries for small files (CVE-2026-44722)
  • 919e199 Merge pull request #42 from danifus/update202605
  • 61d3529 Quote python versions in github workflow to fix 3.10
  • Additional commits viewable in compare view

Updates langchain from 0.3.30 to 1.3.9

Release notes

Sourced from langchain's releases.

langchain==1.3.9

Changes since langchain==1.3.8

release(anthropic): 1.4.6 (#38105) release(...

Description has been truncated

@dependabot
build(deps): bump the pip group across 3 directories with 12 updates
ce1bcb0 
Bumps the pip group with 1 update in the /integrations/bbot directory: [bbot](https://github.com/blacklanternsecurity/bbot).
Bumps the pip group with 1 update in the /integrations/malware_tools_analyzers/requirements directory: [flask](https://github.com/pallets/flask).
Bumps the pip group with 10 updates in the /requirements directory:

| Package | From | To |
| --- | --- | --- |
| [pycti](https://github.com/OpenCTI-Platform/opencti) | `6.8.8` | `6.9.7` |
| [authlib](https://github.com/authlib/authlib) | `1.6.5` | `1.6.12` |
| [daphne](https://github.com/django/daphne) | `4.2.1` | `4.2.2` |
| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.41` | `3.1.58` |
| [lief](https://github.com/lief-project/LIEF) | `0.15.1` | `0.17.2` |
| [pillow](https://github.com/python-pillow/Pillow) | `11.0.0` | `12.3.0` |
| [pyzipper](https://github.com/danifus/pyzipper) | `0.3.6` | `0.4.0` |
| [langchain](https://github.com/langchain-ai/langchain) | `0.3.30` | `1.3.9` |
| [deepdiff](https://github.com/qlustered/deepdiff) | `8.6.1` | `8.6.2` |
| [lxml](https://github.com/lxml/lxml) | `6.0.2` | `6.1.0` |



Updates `bbot` from 2.7.2 to 3.0.0
- [Release notes](https://github.com/blacklanternsecurity/bbot/releases)
- [Changelog](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/release_history.md)
- [Commits](https://github.com/blacklanternsecurity/bbot/commits/v3.0.0)

Updates `flask` from 3.1.1 to 3.1.3
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.1...3.1.3)

Updates `pycti` from 6.8.8 to 6.9.7
- [Release notes](https://github.com/OpenCTI-Platform/opencti/releases)
- [Commits](OpenCTI-Platform/opencti@6.8.8...6.9.7)

Updates `authlib` from 1.6.5 to 1.6.12
- [Release notes](https://github.com/authlib/authlib/releases)
- [Changelog](https://github.com/authlib/authlib/blob/1.6.12/docs/changelog.rst)
- [Commits](authlib/authlib@v1.6.5...1.6.12)

Updates `daphne` from 4.2.1 to 4.2.2
- [Changelog](https://github.com/django/daphne/blob/main/CHANGELOG.txt)
- [Commits](django/daphne@4.2.1...4.2.2)

Updates `gitpython` from 3.1.41 to 3.1.58
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@3.1.41...3.1.58)

Updates `lief` from 0.15.1 to 0.17.2
- [Release notes](https://github.com/lief-project/LIEF/releases)
- [Commits](lief-project/LIEF@0.15.1...0.17.2)

Updates `pillow` from 11.0.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@11.0.0...12.3.0)

Updates `pyzipper` from 0.3.6 to 0.4.0
- [Changelog](https://github.com/danifus/pyzipper/blob/master/HISTORY.rst)
- [Commits](danifus/pyzipper@v0.3.6...v0.4.0)

Updates `langchain` from 0.3.30 to 1.3.9
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain==0.3.30...langchain==1.3.9)

Updates `deepdiff` from 8.6.1 to 8.6.2
- [Release notes](https://github.com/qlustered/deepdiff/releases)
- [Changelog](https://github.com/qlustered/deepdiff/blob/master/CHANGELOG.md)
- [Commits](qlustered/deepdiff@8.6.1...8.6.2)

Updates `lxml` from 6.0.2 to 6.1.0
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-6.0.2...lxml-6.1.0)

---
updated-dependencies:
- dependency-name: bbot
  dependency-version: 3.0.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: flask
  dependency-version: 3.1.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pycti
  dependency-version: 6.9.7
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: authlib
  dependency-version: 1.6.12
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: daphne
  dependency-version: 4.2.2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: gitpython
  dependency-version: 3.1.58
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: lief
  dependency-version: 0.17.2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pyzipper
  dependency-version: 0.4.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: langchain
  dependency-version: 1.3.9
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: deepdiff
  dependency-version: 8.6.2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: lxml
  dependency-version: 6.1.0
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants