chore(deps): bump bandit from 1.12.0 to 1.12.4 in the elixir-minor group

[dependabot]

Bumps the elixir-minor group with 1 update: bandit.

Updates bandit from 1.12.0 to 1.12.4

Changelog

Sourced from bandit's changelog.

1.12.4 (27 July 2026)

Fixes

• Properly send Connection: close header when client requests closure (#617)
• Disallow transfer-encoding on HTTP/1.0 connections (#618)
• Reject requests with multiple Host headers (#619)
• Reject malformed header lines (#620)
• Fix handling of chunk extensions (#621)

Enhancements

• Tighten up CI against supply chain attacks (#623, thanks @​Totara-thib!)
• Reorganize and increase coverage of HTTP/1 tests to better match RFC structure (#616)
• Tolerate a leading newline on HTTP/1 requests (#622)
• Send "100 Continue" interim response before reading body if client requests it (#624)

1.12.3 (25 July 2026)

Enhancements

• Cache connection-level data between HTTP/1 keepalives (#603, thanks @​preciz!)

1.12.2 (25 July 2026)

Enhancements

• Improve internal HTTP/2 error handling to be better about closing stream/connection
• Coalesce header and body in to single transport send (#606, thanks @​NelsonVides!)
• Improve compression behaviour when streaming an explicitly length delimited body (#605, thanks @​elibosley!)
• Quiet WebSocket deserialization erorrs, add verbosity config lever (#610, thanks @​ericmj!)
• Send connection: close when we're at max_requests (#613, thanks @​joshdchang!)

Fixes

• Fix bogus check for unmasked WebSocket frames (GHSA-rhh8-5xw9-c3gm, thanks @​lukaszsamson!)
• Enforce max_header_list_size if overridden (GHSA-9q5m-g6v3-6772, thanks @​lukaszsamson!)

1.12.1 (24 July 2026)

Fixes

• Fix DoS issue with fragmented WebSocket frames (CVE-2026-65623, thanks @​PJUllrich!)

Commits

• 00d532f Version bump to 1.12.4
• 1663203 Handle clients sending an Expect: 100-continue header before sending a body...
• e3c6595 Fixup linting error
• c430bf5 Reapply "Pin GitHub Actions to commit SHAs (#623)"
• a6fabe8 Revert "Pin GitHub Actions to commit SHAs (#623)"
• e479c3b Pin GitHub Actions to commit SHAs (#623)
• eba04e4 Tolerate a leading empty line before the request line (RFC9112§2.2) (#622)
• c31e9e3 Fix crash on unrecognized chunk extensions (#621)
• c24bc00 Reject header values containing CR, LF, or NUL (#620)
• a518b29 Reject requests with multiple Host headers (#619)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions