build(deps): bump bandit from 1.12.4 to 1.12.5 in the mix-minor group

[dependabot]

Bumps the mix-minor group with 1 update: bandit.

Updates bandit from 1.12.4 to 1.12.5

Changelog

Sourced from bandit's changelog.

1.12.5 (20 Aug 2026)

Changes

• Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532w-jv94) (#671)
• Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings (#665)
• Treat proxy-connection as a connection-specific header in HTTP/2 (#632)
• Return FRAME_SIZE_ERROR for HEADERS/DATA frames too short for their flags (#652)
• Treat abortive-close posix reasons as client closures in logging (#663)

Fixes

• Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) (#670)
• Use PROTOCOL_ERROR for a zero WINDOW_UPDATE increment (#656)
• Reject send_file ranges past EOF instead of emitting a negative Content-Length (#653)
• Reject compressed WebSocket control frames regardless of the fin bit (#651)
• Enforce the RFC9112 chunk-size grammar and reject repeated transfer-encoding (#631)
• Fix typos (#627)
• Fix non-deterministic compile-time code (#646)

Enhancements

• Lazily precompile the invalid-field-value match pattern (#662)
• Add tests for untested configuration options (#659)
• Match the weak-etag prefix W/ explicitly (#657)
• Do not duplicate an existing vary: accept-encoding header (#658)
• Honor the close/keep-alive token inside a comma-separated Connection header (#655)
• Initialize the per-stream receive window from the advertised initial_window_size (#654)
• Keep track of body_length to avoid list iterations (#645)
• Avoid per-header length/1 and option lookups in do_read_headers! (#614) (#626)

Commits

• 9571499 Version bump to 1.12.5
• f6914aa Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532...
• d38cf04 Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) (#670)
• cce7c5f Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings (#...
• eca1713 Fixup recent test noise
• b65c235 Consolidate Plug.Conn.Adapter calling-process tests into adapter_test.exs (#667)
• 4ccc008 Treat abortive-close posix reasons as client closures in logging (#663)
• 274eb55 Lazily precompile the invalid-field-value match pattern (#662)
• 10710de Enforce the chunk-size grammar in a single pass (#661)
• d69202e Unify case-insensitive comma-separated header token checks (#660)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions