[dependabot]

Bumps bandit from 1.13.1 to 1.14.1.

Changelog

Sourced from bandit's changelog.

1.14.1 (28 Oct 2026)

Changes

• Close an HTTP/1 connection after a 2xx response to CONNECT, as RFC 9110 §9.3.6 requires. Before, the connection stayed open and could serve a later request (#729, thanks @​neilberkman!)
• Reject an HTTP/2 request whose host header does not match :authority, or that has more than one host header, with a stream PROTOCOL_ERROR (RFC 9113 §8.3.1) (#725, thanks @​neilberkman!)
• Remove connection-specific header fields (connection, keep-alive, proxy-connection, transfer-encoding and upgrade) from HTTP/2 responses, as RFC 9113 §8.2.2 requires. Before, clients such as curl and Firefox reset the stream (#728, thanks @​mpettibone!)

Fixes

• Collect HTTP/2 request bodies into one binary, so that a body sent as many tiny DATA frames no longer uses many times its size in memory (GHSA-pxjf-g536-7r93, thanks @​neilberkman!)
• Read Accept-Encoding q-values with the RFC 9110 §12.4.2 grammar. Before, a q-value with a very long integer part caused a 500 on every request (#733, thanks @​mpettibone!)
• Remove trailing whitespace from HTTP/1 header values (RFC 9110 §5.5). Before, a Host header with a trailing space got a 400 (#731, thanks @​mpettibone!)
• Reject an IPv6 literal authority with no colon before the port (for example [::1]80) (RFC 3986 §3.2) (#730, thanks @​neilberkman!)
• Send RST_STREAM for an oversized HTTP/2 header block as a stream error, and keep the HPACK decoder state (RFC 9113 §5.4.2) (#726, thanks @​neilberkman!)

1.14.0 (26 Oct 2026)

Changes

• Advertise a default HTTP/2 max_concurrent_streams of 500 and a default max_header_list_size of 262144 bytes in the initial SETTINGS frame. Before, both were unlimited. The entries of a SETTINGS frame are now sorted
• Refill the HTTP/2 connection receive window to 16 MiB as data arrives. Refill a stream receive window to 1 MiB only after the stream reads data. Before, the server granted 2^31-1 bytes on the first DATA frame
• Join HTTP/2 DATA frames into larger messages when a stream is slow to read. As a result, read_body can return more than :length bytes, up to the stream receive window
• Reset an HTTP/2 stream with ENHANCE_YOUR_CALM when it has 100 unread messages, and close the connection with ENHANCE_YOUR_CALM when a client sends more than 100 non-ACK SETTINGS frames in 10 seconds
• Reset an HTTP/2 stream with STREAM_CLOSED when the client sends DATA or HEADERS after END_STREAM
• Send PROTOCOL_ERROR for DATA, WINDOW_UPDATE and RST_STREAM on an idle HTTP/2 stream, and report the last stream that the server started in the GOAWAY frame
• Reject an HTTP/1 absolute-form request target whose path :erlang.decode_packet/3 reads differently from RFC 3986. As a result, a target with an empty path followed by a query (for example http://host:80?a=b) now gets 400. Before, its query was silently discarded
• Require the HTTP/1 request line to have exactly three words, and the version to be exactly HTTP/1.1 or HTTP/1.0
• Accept optional whitespace before the ; of a chunk extension, as RFC 9112 §7.1.1 permits

... (truncated)

Commits

• 710614b Version bump to 1.14.1
• 327bb02 Merge commit from fork
• 81f50c2 Bug fix: Bound Accept-Encoding q-values to the RFC9110§12.4.2 grammar before ...
• 2431e06 Logo updates
• ecea805 Bump elixir-ci-actions to pinned-actions commit (#732)
• 31636b5 Trim trailing whitespace from HTTP/1 header values (RFC9110§5.5) (#731)
• 4d7203d Reject IPv6 authority ports without a colon (#730)
• b8971bf Close HTTP/1 connections after successful CONNECT responses (#729)
• de3fc8c Add files via upload (#728)
• 0ac00c3 Bump getplumber/plumber from 0.7.0 to 0.7.11 (#727)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)