* Bump actions/checkout from 5 to 6

Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update .github/workflows/build-publish-image.yml

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Eric Brown <ericwb@users.noreply.github.com>

updates:
- [github.com/asottile/pyupgrade: v3.21.1 → v3.21.2](asottile/pyupgrade@v3.21.1...v3.21.2)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Fix B608 to detect VALUES( without space

The current regex pattern for INSERT statements requires a whitespace
character after VALUES, but VALUES( is valid SQL syntax and commonly
used. This causes potential SQL injection cases to go undetected.

Changed the regex from `values\s` to `values[\s(]` to match both
`VALUES (` and `VALUES(` patterns.

Resolves: #1336

* Add check for hardcoded passwords in dicts.

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

updates:
- [github.com/psf/black-pre-commit-mirror: 25.11.0 → 25.12.0](psf/black-pre-commit-mirror@25.11.0...25.12.0)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Update CONTRIBUTING.md for Python 3.10

Bandit requires a Python version 3.10 or greater. CONTRIBUTING.md includes a required test running Python 3.9. This commit updates the test in the documentation for Python 3.10.

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Limit B614 to torch.load deserializers

Avoids false positives for torch.*.load helpers such as
torch.utils.cpp_extension.load while preserving checks for
torch.load and torch.serialization.load.
Updated docstrings and example to reflect expected behavior.

Resolves: #1343

* Update examples/pytorch_load.py

---------

Co-authored-by: Eric Brown <ericwb@users.noreply.github.com>