Skip to content

build(deps): bump the pip group across 9 directories with 11 updates - #3877

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/integrations/bbot/pip-91aea5f717
Open

build(deps): bump the pip group across 9 directories with 11 updates#3877
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/integrations/bbot/pip-91aea5f717

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip group with 1 update in the /integrations/bbot directory: bbot.
Bumps the pip group with 1 update in the /integrations/malware_tools_analyzers/requirements directory: flask.
Bumps the pip group with 1 update in the /integrations/nuclei_analyzer directory: flask.
Bumps the pip group with 1 update in the /integrations/pcap_analyzers directory: flask.
Bumps the pip group with 1 update in the /integrations/phishing_analyzers directory: flask.
Bumps the pip group with 1 update in the /integrations/phunter directory: flask.
Bumps the pip group with 1 update in the /integrations/thug directory: flask.
Bumps the pip group with 1 update in the /integrations/tor_analyzers directory: flask.
Bumps the pip group with 9 updates in the /requirements directory:

Package From To
authlib 1.6.5 1.6.12
daphne 4.2.1 4.2.2
lief 0.15.1 0.17.2
pillow 11.0.0 12.3.0
pyzipper 0.3.6 0.4.0
langchain 0.3.30 1.3.9
deepdiff 8.6.1 8.6.2
lxml 6.0.2 6.1.0
pycti 6.8.8 6.9.7

Updates bbot from 2.7.2 to 3.0.0

Release notes

Sourced from bbot's releases.

3.0.0

BBOT 3.0.0

[!WARNING] Upgrading from 2.x is not drop-in. The CLI, flags, preset syntax, event API, config keys, and module set all changed in backwards-incompatible ways. Read the 2.x to 3.0 migration guide before upgrading. The changes most likely to bite:

  • -s now means --seeds, not --silent (silent moved to -S). A script passing -s for quiet output will now add a seed instead, with no error.
  • --whitelist was retired: -t/--targets now defines scope, and -s/--seeds drives the scan.
  • --allow-deadly was removed, and several flags were renamed (e.g. noisy to loud).
  • Module options are now pydantic-validated; the legacy options dict hard-fails.
  • Some event types, event attributes, and config keys were renamed or removed.

Highlights

  • New HTTP engine (blasthttp): in-process, rate-limited HTTP replacing the httpx subprocess (#2992, #3021)
  • New DNS engine (BlastDNS) (#3042)
  • Pydantic config + preset validation: typos and type errors are caught before a scan starts (#2486, #3058)
  • Scope rework: clean split between target (scope) and seeds (drivers); --whitelist retired (#2789)
  • Findings and Vulnerabilities unified, with Severity and Confidence (#2436, #2740)
  • asndb: faster ASN enrichment, plus ASNs usable as scan targets (#2957, #2741)
  • Lightfuzz overhaul: new SSRF and ESI submodules, far fewer false positives (#2967)
  • Major performance work: memory and CPU optimizations, bounded DNS caches, HTTP body stripping, string interning (#2953, #3085, #3088)
  • Preset naming / tag standardization across flags, presets, and event tags (#2986)
  • New modules: MongoDB / Elastic / Kafka / RabbitMQ / ZeroMQ / NATS outputs, legba, trajan, virtualhost, waf_bypass, dnsspf, Hetzner bucket
  • Modules removed: wappalyzer, smuggler, digitorus, sitedossier, passivetotal, wpscan

Core & Packaging

  • Packaging moved from Poetry to uv + hatchling, and supported Python is now 3.10 - 3.14 (#2900, #2731).
  • Config values and presets are validated with pydantic before a scan runs, so typos and wrong types fail fast instead of silently doing nothing. The legacy per-module options dict is no longer accepted (#2486, #3058, #3119).
  • Malformed YAML in a config or preset now produces a readable error instead of a stack trace (#3159).
  • New --reset-config / --reset-secrets to regenerate stale config files (#3240).

Scope & Targeting

  • Scope was reworked around a target/seeds split: -t/--targets defines scope, -s/--seeds supplies the starting events, --whitelist is gone, and --strict-scope now means "this exact host only" (#2789).
  • ASNs can be used directly as scan targets (#2741).
  • Files can be passed as targets, seeds, or blacklist entries inside presets, and target lists may contain comments (#2996, #3031).

HTTP & Web

  • All web traffic now runs in-process through one shared, rate-limited client (blasthttp) instead of a separate httpx subprocess (#2992, #3021).
  • HTTP wildcard/catch-all host detection cuts false positives on servers that answer every request (#3164).
  • 429 Too Many Requests responses are now honored for rate limiting (#3145).
  • HTTP timeout settings were consolidated into one place (#3222).
  • SSL verification was split so BBOT verifies its own infrastructure calls by default while still not verifying untrusted target traffic (#3186).

DNS

... (truncated)

Changelog

Sourced from bbot's changelog.

2.8.6 - Jun 16, 2026

2.8.5 - Jun 16, 2026

2.8.4 - Mar 17, 2026

2.8.3 - Feb 26, 2026

2.8.2 - Feb 12, 2026

2.8.1 - Jan 30, 2026

2.8.0 - Jan 20, 2026

Commits

Updates flask from 3.1.1 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

  • stream_with_context does not fail inside async views. #5774
  • When using follow_redirects in the test client, the final state of session is correct. #5786
  • Relax type hint for passing bytes IO to send_file. #5776
Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

  • stream_with_context does not fail inside async views. :issue:5774
  • When using follow_redirects in the test client, the final state of session is correct. :issue:5786
  • Relax type hint for passing bytes IO to send_file. :issue:5776
Commits
  • 22d9247 release version 3.1.3
  • 089cb86 Merge commit from fork
  • c17f379 request context tracks session access
  • 27be933 start version 3.1.3
  • 4e652d3 Abort if the instance folder cannot be created (#5903)
  • 3d03098 Abort if the instance folder cannot be created
  • 407eb76 document using gevent for async (#5900)
  • ac5664d document using gevent for async
  • 4f79d5b Increase required flit_core version to 3.11 (#5865)
  • fe3b215 Increase required flit_core version to 3.11
  • Additional commits viewable in compare view

Updates flask from 3.1.1 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

  • stream_with_context does not fail inside async views. #5774
  • When using follow_redirects in the test client, the final state of session is correct. #5786
  • Relax type hint for passing bytes IO to send_file. #5776
Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

  • stream_with_context does not fail inside async views. :issue:5774
  • When using follow_redirects in the test client, the final state of session is correct. :issue:5786
  • Relax type hint for passing bytes IO to send_file. :issue:5776
Commits
  • 22d9247 release version 3.1.3
  • 089cb86 Merge commit from fork
  • c17f379 request context tracks session access
  • 27be933 start version 3.1.3
  • 4e652d3 Abort if the instance folder cannot be created (#5903)
  • 3d03098 Abort if the instance folder cannot be created
  • 407eb76 document using gevent for async (#5900)
  • ac5664d document using gevent for async
  • 4f79d5b Increase required flit_core version to 3.11 (#5865)
  • fe3b215 Increase required flit_core version to 3.11
  • Additional commits viewable in compare view

Updates flask from 3.1.1 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

  • stream_with_context does not fail inside async views. #5774
  • When using follow_redirects in the test client, the final state of session is correct. #5786
  • Relax type hint for passing bytes IO to send_file. #5776
Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

  • stream_with_context does not fail inside async views. :issue:5774
  • When using follow_redirects in the test client, the final state of session is correct. :issue:5786
  • Relax type hint for passing bytes IO to send_file. :issue:5776
Commits
  • 22d9247 release version 3.1.3
  • 089cb86 Merge commit from fork
  • c17f379 request context tracks session access
  • 27be933 start version 3.1.3
  • 4e652d3 Abort if the instance folder cannot be created (#5903)
  • 3d03098 Abort if the instance folder cannot be created
  • 407eb76 document using gevent for async (#5900)
  • ac5664d document using gevent for async
  • 4f79d5b Increase required flit_core version to 3.11 (#5865)
  • fe3b215 Increase required flit_core version to 3.11
  • Additional commits viewable in compare view

Updates flask from 3.0.3 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

  • stream_with_context does not fail inside async views. #5774
  • When using follow_redirects in the test client, the final state of session is correct. #5786
  • Relax type hint for passing bytes IO to send_file. #5776
Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

  • stream_with_context does not fail inside async views. :issue:5774
  • When using follow_redirects in the test client, the final state of session is correct. :issue:5786
  • Relax type hint for passing bytes IO to send_file. :issue:5776
Commits
  • 22d9247 release version 3.1.3
  • 089cb86 Merge commit from fork
  • c17f379 request context tracks session access
  • 27be933 start version 3.1.3
  • 4e652d3 Abort if the instance folder cannot be created (#5903)
  • 3d03098 Abort if the instance folder cannot be created
  • 407eb76 document using gevent for async (#5900)
  • ac5664d document using gevent for async
  • 4f79d5b Increase required flit_core version to 3.11 (#5865)
  • fe3b215 Increase required flit_core version to 3.11
  • Additional commits viewable in compare view

Updates flask from 3.1.1 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

  • stream_with_context does not fail inside async views. #5774
  • When using follow_redirects in the test client, the final state of session is correct. #5786
  • Relax type hint for passing bytes IO to send_file. #5776
Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

  • stream_with_context does not fail inside async views. :issue:5774
  • When using follow_redirects in the test client, the final state of session is correct. :issue:5786
  • Relax type hint for passing bytes IO to send_file. :issue:5776
Commits
  • 22d9247 release version 3.1.3
  • 089cb86 Merge commit from fork
  • c17f379 request context tracks session access
  • 27be933 start version 3.1.3
  • 4e652d3 Abort if the instance folder cannot be created (#5903)
  • 3d03098 Abort if the instance folder cannot be created
  • 407eb76 document using gevent for async (#5900)
  • ac5664d document using gevent for async
  • 4f79d5b Increase required flit_core version to 3.11 (#5865)
  • fe3b215 Increase required flit_core version to 3.11
  • Additional commits viewable in compare view

Updates flask from 3.1.1 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

  • stream_with_context does not fail inside async views. #5774
  • When using follow_redirects in the test client, the final state of session is correct. #5786
  • Relax type hint for passing bytes IO to send_file. #5776
Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

  • stream_with_context does not fail inside async views. :issue:5774
  • When using follow_redirects in the test client, the final state of session is correct. :issue:5786
  • Relax type hint for passing bytes IO to send_file. :issue:5776
Commits
  • 22d9247 release version 3.1.3
  • 089cb86 Merge commit from fork
  • c17f379 request context tracks session access
  • 27be933 start version 3.1.3
  • 4e652d3 Abort if the instance folder cannot be created (#5903)
  • 3d03098 Abort if the instance folder cannot be created
  • 407eb76 document using gevent for async (#5900)
  • ac5664d document using gevent for async
  • 4f79d5b Increase required flit_core version to 3.11 (#5865)
  • fe3b215 Increase required flit_core version to 3.11
  • Additional commits viewable in compare view

Updates flask from 3.1.1 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

  • stream_with_context does not fail inside async views. #5774
  • When using follow_redirects in the test client, the final state of session is correct. #5786
  • Relax type hint for passing bytes IO to send_file. #5776
Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

  • stream_with_context does not fail inside async views. :issue:5774
  • When using follow_redirects in the test client, the final state of session is correct. :issue:5786
  • Relax type hint for passing bytes IO to send_file. :issue:5776
Commits
  • 22d9247 release version 3.1.3
  • 089cb86 Merge commit from fork
  • c17f379 request context tracks session access
  • 27be933 start version 3.1.3
  • 4e652d3 Abort if the instance folder cannot be created (#5903)
  • 3d03098 Abort if the instance folder cannot be created
  • 407eb76 document using gevent for async (#5900)
  • ac5664d document using gevent for async
  • 4f79d5b Increase required flit_core version to 3.11 (#5865)
  • fe3b215 Increase required flit_core version to 3.11
  • Additional commits viewable in compare view

Updates authlib from 1.6.5 to 1.6.12

Release notes

Sourced from authlib's releases.

v1.6.12

v1.6.11

Full Changelog: authlib/authlib@v1.6.10...v1.6.11

  • Fix CSRF issue with starlette client

v1.6.10

Full Changelog: authlib/authlib@v1.6.9...v1.6.10

  • Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

v1.6.9

Full Changelog: authlib/authlib@v1.6.8...v1.6.9

Changes in jose module

  • Not using header's jwk automatically
  • Add ES256K into default jwt algorithms
  • Remove deprecated algorithm from default registry
  • Generate random cek when cek length doesn't match

v1.6.8

Full Changelog: authlib/authlib@v1.6.7...v1.6.8

  • Add EdDSA to default jwt instance.

v1.6.7

Full Changelog: authlib/authlib@v1.6.6...v1.6.7

Set supported algorithms for the default jwt instance.

v1.6.6

What's Changed

New Contributors

Full Changelog: authlib/authlib@v1.6.5...v1.6.6

Changelog

Sourced from authlib's changelog.

Version 1.6.12

Released on may 4, 2026

  • Fix redirecting to unvalidated redirect_uri on InvalidScopeError in OpenIDImplicitGrant and OpenIDHybridGrant.

Version 1.6.11

Released on Apr 16, 2026

  • Fix CSRF vulnerability in the Starlette OAuth client when a cache is configured.

Version 1.6.10

Released on Apr 13, 2026

  • Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Version 1.6.9

Released on Mar 2, 2026

  • Not using header's jwk automatically.
  • Add ES256K into default jwt algorithms.
  • Remove deprecated algorithm from default registry.
  • Generate random cek when cek length doesn't match.

Version 1.6.8

Released on Feb 17, 2026

  • Add EdDSA to default jwt instance.

Version 1.6.7

Released on Feb 6, 2026

  • Set supported algorithms for the default jwt instance.

Version 1.6.6

... (truncated)

Commits
  • e46e515 chore: bump to 1.6.12
  • 9babc13 fix: redirecting to unvalidated redirect_uri on InvalidScopeError in OIDC grants
  • 0dc0e5b chore: bump to 1.6.11
  • aa7b8e4 Merge commit from fork
  • 401a770 fix: CSRF issue with starlette client
  • ef09aeb chore: release 1.6.10
  • 3be0846 fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError
  • 9266eaa chore: release 1.6.9
  • b9bb2b2 fix(oidc): fail close at validating c_hash and at_hash
  • 1b0a1d9 fix(jose): generate random cek when cek length doesn't match
  • Additional commits viewable in compare view

Updates daphne from 4.2.1 to 4.2.2

Changelog

Sourced from daphne's changelog.

4.2.2 (2026-06-03)

  • Fixed a denial of service vulnerability via unbounded WebSocket message sizes. Daphne previously passed no message or frame size limits to autobahn, whose defaults are unbounded. This allowed an unauthenticated client to exhaust server memory by sending a very large WebSocket messages/frames (CVE-2026-44545).

    Both limits now default to 1 MiB and can be configured via the new --websocket-max-message-size and --websocket-max-frame-size CLI flags (or the matching Server constructor arguments). Pass 0 to restore the previous unlimited behaviour.

    Thanks to ParkHyunWoo for the report.

  • Fixed a header injection vulnerability on the WebSocket upgrade path (CVE-2026-44546).

    Header values containing \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 were parsed as a single header by Twisted but split into multiple headers by autobahn during the WebSocket handshake. An attacker could exploit this parser differential to smuggle additional headers (e.g. authentication tokens, X-Forwarded-For, Origin, Daphne-Root-Path) into the ASGI scope passed to the application.

    Daphne now rejects requests carrying these bytes in any header value with a 400 Bad Request response, as required by RFC 9110 §5.5.

    Thanks to Rene Henningsen for the report.

Commits

Updates lief from 0.15.1 to 0.17.2

Release notes

Sourced from lief's releases.

0.17.2

https://lief.re/doc/stable/changelog.html#january-3rd-2026

0.17.1

See: https://lief.re/doc/stable/changelog.html#october-25th-2025

v0.17.0

v0.16.7

No release notes provided.

v0.16.6

See: https://lief.re/doc/stable/changelog.html#may-29th-2025

0.16.5

See: https://lief.re/doc/stable/changelog.html#april-19th-2025

Compared to previous releases, this release adds new pre-compiled packages for:

  • Alpine ARM64 (based on Musl)
  • Windows ARM64
  • Alpine i686/i386 (based on Musl)

0.16.4

See: https://lief.re/doc/stable/changelog.html#february-23rd-2025

0.16.3

See: https://lief.re/doc/stable/changelog.html#february-1st-2025

0.16.2

https://lief.re/doc/stable/changelog.html#january-1st-2025

0.16.1

https://lief.re/doc/stable/changelog.html#december-26th-2024

v0.16.0

https://lief.re/doc/stable/changelog.html#december-10th-2024

Commits

Updates pillow from 11.0.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Documentation

Dependencies

@dependabot
build(deps): bump the pip group across 9 directories with 11 updates
dd75a64 
Bumps the pip group with 1 update in the /integrations/bbot directory: [bbot](https://github.com/blacklanternsecurity/bbot).
Bumps the pip group with 1 update in the /integrations/malware_tools_analyzers/requirements directory: [flask](https://github.com/pallets/flask).
Bumps the pip group with 1 update in the /integrations/nuclei_analyzer directory: [flask](https://github.com/pallets/flask).
Bumps the pip group with 1 update in the /integrations/pcap_analyzers directory: [flask](https://github.com/pallets/flask).
Bumps the pip group with 1 update in the /integrations/phishing_analyzers directory: [flask](https://github.com/pallets/flask).
Bumps the pip group with 1 update in the /integrations/phunter directory: [flask](https://github.com/pallets/flask).
Bumps the pip group with 1 update in the /integrations/thug directory: [flask](https://github.com/pallets/flask).
Bumps the pip group with 1 update in the /integrations/tor_analyzers directory: [flask](https://github.com/pallets/flask).
Bumps the pip group with 9 updates in the /requirements directory:

| Package | From | To |
| --- | --- | --- |
| [authlib](https://github.com/authlib/authlib) | `1.6.5` | `1.6.12` |
| [daphne](https://github.com/django/daphne) | `4.2.1` | `4.2.2` |
| [lief](https://github.com/lief-project/LIEF) | `0.15.1` | `0.17.2` |
| [pillow](https://github.com/python-pillow/Pillow) | `11.0.0` | `12.3.0` |
| [pyzipper](https://github.com/danifus/pyzipper) | `0.3.6` | `0.4.0` |
| [langchain](https://github.com/langchain-ai/langchain) | `0.3.30` | `1.3.9` |
| [deepdiff](https://github.com/qlustered/deepdiff) | `8.6.1` | `8.6.2` |
| [lxml](https://github.com/lxml/lxml) | `6.0.2` | `6.1.0` |
| [pycti](https://github.com/OpenCTI-Platform/opencti) | `6.8.8` | `6.9.7` |



Updates `bbot` from 2.7.2 to 3.0.0
- [Release notes](https://github.com/blacklanternsecurity/bbot/releases)
- [Changelog](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/release_history.md)
- [Commits](https://github.com/blacklanternsecurity/bbot/commits/v3.0.0)

Updates `flask` from 3.1.1 to 3.1.3
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.1...3.1.3)

Updates `flask` from 3.1.1 to 3.1.3
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.1...3.1.3)

Updates `flask` from 3.1.1 to 3.1.3
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.1...3.1.3)

Updates `flask` from 3.0.3 to 3.1.3
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.1...3.1.3)

Updates `flask` from 3.1.1 to 3.1.3
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.1...3.1.3)

Updates `flask` from 3.1.1 to 3.1.3
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.1...3.1.3)

Updates `flask` from 3.1.1 to 3.1.3
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.1...3.1.3)

Updates `authlib` from 1.6.5 to 1.6.12
- [Release notes](https://github.com/authlib/authlib/releases)
- [Changelog](https://github.com/authlib/authlib/blob/1.6.12/docs/changelog.rst)
- [Commits](authlib/authlib@v1.6.5...1.6.12)

Updates `daphne` from 4.2.1 to 4.2.2
- [Changelog](https://github.com/django/daphne/blob/main/CHANGELOG.txt)
- [Commits](django/daphne@4.2.1...4.2.2)

Updates `lief` from 0.15.1 to 0.17.2
- [Release notes](https://github.com/lief-project/LIEF/releases)
- [Commits](lief-project/LIEF@0.15.1...0.17.2)

Updates `pillow` from 11.0.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@11.0.0...12.3.0)

Updates `pyzipper` from 0.3.6 to 0.4.0
- [Changelog](https://github.com/danifus/pyzipper/blob/master/HISTORY.rst)
- [Commits](danifus/pyzipper@v0.3.6...v0.4.0)

Updates `langchain` from 0.3.30 to 1.3.9
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain==0.3.30...langchain==1.3.9)

Updates `deepdiff` from 8.6.1 to 8.6.2
- [Release notes](https://github.com/qlustered/deepdiff/releases)
- [Changelog](https://github.com/qlustered/deepdiff/blob/master/CHANGELOG.md)
- [Commits](qlustered/deepdiff@8.6.1...8.6.2)

Updates `lxml` from 6.0.2 to 6.1.0
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-6.0.2...lxml-6.1.0)

Updates `pycti` from 6.8.8 to 6.9.7
- [Release notes](https://github.com/OpenCTI-Platform/opencti/releases)
- [Commits](OpenCTI-Platform/opencti@6.8.8...6.9.7)

---
updated-dependencies:
- dependency-name: bbot
  dependency-version: 3.0.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: flask
  dependency-version: 3.1.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: flask
  dependency-version: 3.1.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: flask
  dependency-version: 3.1.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: flask
  dependency-version: 3.1.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: flask
  dependency-version: 3.1.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: flask
  dependency-version: 3.1.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: flask
  dependency-version: 3.1.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: authlib
  dependency-version: 1.6.12
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: daphne
  dependency-version: 4.2.2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: lief
  dependency-version: 0.17.2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pyzipper
  dependency-version: 0.4.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: langchain
  dependency-version: 1.3.9
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: deepdiff
  dependency-version: 8.6.2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: lxml
  dependency-version: 6.1.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pycti
  dependency-version: 6.9.7
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jul 21, 2026
@github-actions

github-actions Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

This pull request has been marked as stale because it has had no activity for 10 days. If you are still working on this, please provide some updates or it will be closed in 5 days.

@github-actions github-actions Bot added the stale label Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code stale

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants