# What changed in bandit

> 10 changes in bandit 1 from its official release notes, upgrade guides and advisories: 2 security. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/pypi/bandit/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## bandit 1

### Security

- Adds a check for hardcoded passwords in dictionaries. (1.9.3) — [release notes](https://github.com/PyCQA/bandit/releases/tag/1.9.3)
- B614 is limited to torch.load deserializers. (1.9.3) — [release notes](https://github.com/PyCQA/bandit/releases/tag/1.9.3)

### Behavior and default changes

- Lowers the version guard to Python 3.12. (1.9.4) — [release notes](https://github.com/PyCQA/bandit/releases/tag/1.9.4)
- The 'no failed test' warning now includes the filename. (1.9.4) — [release notes](https://github.com/PyCQA/bandit/releases/tag/1.9.4)

### Tooling

- Argparse enhancements for Python 3.14 affect Bandit's command-line interface. (1.9.2) — [release notes](https://github.com/PyCQA/bandit/releases/tag/1.9.2)

### Fixes and other changes

- Fixes incorrect line-number reporting on multiline function calls. (1.9.4) — [release notes](https://github.com/PyCQA/bandit/releases/tag/1.9.4)
- Fixes a crash when B613 reads from stdin. (1.9.4) — [release notes](https://github.com/PyCQA/bandit/releases/tag/1.9.4)
- Fixes a false positive when the revision is set via a variable. (1.9.4) — [release notes](https://github.com/PyCQA/bandit/releases/tag/1.9.4)
- B608 now detects VALUES( without a space. (1.9.3) — [release notes](https://github.com/PyCQA/bandit/releases/tag/1.9.3)
- Bandit checks whether a Constant value is a string. (1.9.2) — [release notes](https://github.com/PyCQA/bandit/releases/tag/1.9.2)