build(deps): bump flare-capa from 9.3.1 to 9.4.0 in /requirements

[dependabot]

Bumps flare-capa from 9.3.1 to 9.4.0.

Release notes

Sourced from flare-capa's releases.

v9.4.0

This release includes Ghidra PyGhidra support, performance improvements, dependency updates, and 26 new rules. We'd like to thank the following contributors: @​devs6186, Daniel Adeboye (@​adeboyedn), Aditya Pandey (@​EclipseAditya), aryanyk, Ben Knutson (@​blenbot), @​cosmoworker, kamran ul haq (@​kami922), @​Maijin, @​res2500, and others!

New Features

• ghidra: support PyGhidra @​mike-hunhoff #2788
• vmray: extract number features from whitelisted void_ptr parameters (hKey, hKeyRoot) @​adeboyedn #2835

Breaking Changes

New Rules (26)

• nursery/run-as-nodejs-native-module mehunhoff@google.com
• nursery/inject-shellcode-using-thread-pool-work-insertion-with-tp_io still@teamt5.org
• nursery/inject-shellcode-using-thread-pool-work-insertion-with-tp_timer still@teamt5.org
• nursery/inject-shellcode-using-thread-pool-work-insertion-with-tp_work still@teamt5.org
• data-manipulation/encryption/hc-256/encrypt-data-using-hc-256 wballenthin@hex-rays.com
• anti-analysis/anti-llm/terminate-anthropic-session-via-magic-strings wballenthin@hex-rays.com
• nursery/access-aws-credentials maximemorin@google.com
• nursery/access-cloudflare-credentials maximemorin@google.com
• nursery/access-docker-credentials maximemorin@google.com
• nursery/access-gcp-credentials maximemorin@google.com
• nursery/access-kubernetes-credentials maximemorin@google.com
• nursery/enumerate-aws-cloudformation maximemorin@google.com
• nursery/enumerate-aws-cloudtrail maximemorin@google.com
• nursery/enumerate-aws-direct-connect maximemorin@google.com
• nursery/enumerate-aws-ec2 maximemorin@google.com
• nursery/enumerate-aws-iam maximemorin@google.com
• nursery/enumerate-aws-s3 maximemorin@google.com
• nursery/enumerate-aws-support-cases maximemorin@google.com
• persistence/registry/persist-via-shellserviceobjectdelayload-registry-key xpzhxhm@gmail.com
• nursery/get-http-response-date @​cosmoworker
• host-interaction/process/create/create-process-in-dotnet moritz.raabe@mandiant.com social.tarang@gmail.com
• nursery/read-file-in-dotnet moritz.raabe@mandiant.com anushka.virgaonkar@mandiant.com
• nursery/write-file-in-dotnet william.ballenthin@mandiant.com anushka.virgaonkar@mandiant.com
• nursery/escalate-privileges-via-commit_creds-on-linux aryanyk
• nursery/register-netfilter-hook-on-linux aryanyk
• nursery/get-custom-http-header @​msanchit-dev

Bug Fixes

• main: suggest --os flag in unsupported OS error message to help users override ELF OS detection @​devs6186 #2577
• render: escape sample-controlled strings before passing to Rich to prevent MarkupError @​devs6186 #2699
• rules: handle empty or invalid YAML documents gracefully in Rule.from_yaml and get_rules @​devs6186 #2900
• Fixed insecure deserialization vulnerability in YAML loading @​0x1622 (#2770)
• loader: gracefully handle ELF files with unsupported architectures kamranulhaq2002@gmail.com #2800
• loader: handle SegmentationViolation for malformed ELF files @​kami922 #2799
• lint: disable rule caching during linting @​Maijin #2817
• vmray: skip processes with invalid PID or missing filename @​EclipseAditya #2807
• features: fix Regex.get_value_str() returning escaped pattern instead of raw regex @​EclipseAditya #1909
• render: use default styling for dynamic -vv API/call details so they are easier to see @​devs6186 #1865

... (truncated)

Changelog

Sourced from flare-capa's changelog.

v9.4.0

This release includes Ghidra PyGhidra support, performance improvements, dependency updates, and 26 new rules. We'd like to thank the following contributors: @​0x1622, Daniel Adeboye (@​adeboyedn), Aditya Pandey (@​EclipseAditya), aryanyk, Ben Knutson (@​blenbot), @​cosmoworker, @​devs6186, @​doomedraven, kamran ul haq (@​kami922), @​Maijin, @​res2500, and others!

New Features

• ghidra: support PyGhidra @​mike-hunhoff #2788
• vmray: extract number features from whitelisted void_ptr parameters (hKey, hKeyRoot) @​adeboyedn #2835

Breaking Changes

New Rules (26)

• nursery/run-as-nodejs-native-module mehunhoff@google.com
• nursery/inject-shellcode-using-thread-pool-work-insertion-with-tp_io still@teamt5.org
• nursery/inject-shellcode-using-thread-pool-work-insertion-with-tp_timer still@teamt5.org
• nursery/inject-shellcode-using-thread-pool-work-insertion-with-tp_work still@teamt5.org
• data-manipulation/encryption/hc-256/encrypt-data-using-hc-256 wballenthin@hex-rays.com
• anti-analysis/anti-llm/terminate-anthropic-session-via-magic-strings wballenthin@hex-rays.com
• nursery/access-aws-credentials maximemorin@google.com
• nursery/access-cloudflare-credentials maximemorin@google.com
• nursery/access-docker-credentials maximemorin@google.com
• nursery/access-gcp-credentials maximemorin@google.com
• nursery/access-kubernetes-credentials maximemorin@google.com
• nursery/enumerate-aws-cloudformation maximemorin@google.com
• nursery/enumerate-aws-cloudtrail maximemorin@google.com
• nursery/enumerate-aws-direct-connect maximemorin@google.com
• nursery/enumerate-aws-ec2 maximemorin@google.com
• nursery/enumerate-aws-iam maximemorin@google.com
• nursery/enumerate-aws-s3 maximemorin@google.com
• nursery/enumerate-aws-support-cases maximemorin@google.com
• persistence/registry/persist-via-shellserviceobjectdelayload-registry-key xpzhxhm@gmail.com
• nursery/get-http-response-date @​cosmoworker
• host-interaction/process/create/create-process-in-dotnet moritz.raabe@mandiant.com social.tarang@gmail.com
• nursery/read-file-in-dotnet moritz.raabe@mandiant.com anushka.virgaonkar@mandiant.com
• nursery/write-file-in-dotnet william.ballenthin@mandiant.com anushka.virgaonkar@mandiant.com
• nursery/escalate-privileges-via-commit_creds-on-linux aryanyk
• nursery/register-netfilter-hook-on-linux aryanyk
• nursery/get-custom-http-header @​msanchit-dev

Bug Fixes

• main: suggest --os flag in unsupported OS error message to help users override ELF OS detection @​devs6186 #2577
• render: escape sample-controlled strings before passing to Rich to prevent MarkupError @​devs6186 #2699
• rules: handle empty or invalid YAML documents gracefully in Rule.from_yaml and get_rules @​devs6186 #2900
• Fixed insecure deserialization vulnerability in YAML loading @​0x1622 (#2770)
• loader: gracefully handle ELF files with unsupported architectures kamranulhaq2002@gmail.com #2800
• loader: handle SegmentationViolation for malformed ELF files @​kami922 #2799
• lint: disable rule caching during linting @​Maijin #2817
• vmray: skip processes with invalid PID or missing filename @​EclipseAditya #2807
• features: fix Regex.get_value_str() returning escaped pattern instead of raw regex @​EclipseAditya #1909

... (truncated)

Commits

• 7a79f79 Merge pull request #2982 from mandiant/fix/workflow-zip-env
• 4e4e163 ci: fix ZIP_NAME environment variable in build workflow
• 3276e35 Prepare release v9.4.0 (#2981)
• d9b05ed Sync capa rules submodule
• c5fd75f build(deps): bump pyasn1 from 0.5.1 to 0.6.3 (#2939)
• b82c07d Merge pull request #2980 from mandiant/dependabot/pip/pygments-2.20.0
• 0933594 build(deps): bump pygments from 2.19.1 to 2.20.0
• db84b2c Merge pull request #2978 from mandiant/dependabot/pip/pygithub-2.9.0
• 693233e Merge pull request #2977 from mandiant/dependabot/pip/types-requests-2.33.0.2...
• 66a26d0 build(deps): bump pygments from 2.18.0 to 2.20.0 in /web/rules (#2979)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)