build(deps): bump ioc-finder from 7.0.0 to 9.4.1 in /requirements

[dependabot]

Bumps ioc-finder from 7.0.0 to 9.4.1.

Changelog

Sourced from ioc-finder's changelog.

[9.4.1] - 2026.06.17

Fixed

• Fixed quadratic-time (ReDoS) behavior in the email-address candidate prefilter. The old (?:local+)@domain candidate regex restarted and re-walked the local part at every offset, so a long run of local-part characters (e.g. a base64/hex blob) caused find_iocs to hang — two 100 KB blobs took ~16 minutes each. The prefilter now anchors on @ and expands outward in linear time (_email_candidate_spans), with the domain tail matched by an anchored .match(); the pyparsing email grammar remains the precise validator and detection results are unchanged (#389).

Changed

• Bumped the ioc-fanger dependency floor to 5.1.1 (range >=5.1.1,<5.2).

[9.4.0] - 2026.06.11

Added

• Added a parse_unicode_iocs option to find_iocs (and a --parse_unicode_iocs CLI flag), default False (#298). When enabled, domain labels may contain non-ASCII (Unicode) characters — e.g. warrıors.com (note the dotless ı) is now parsed, as is the domain part of email, URL, and XMPP IOCs. The TLD itself stays ASCII (IANA stores internationalized TLDs in their xn-- punycode form), as do email/URL/XMPP local parts and URL paths. The ASCII and Unicode grammar variants are generated from a single builder (ioc_grammars._build_domain_layer) so they can't drift.

[9.3.0] - 2026.06.05

Changed

• Sped up domain name parsing by bypassing pyparsing for the standalone domain parser: candidate spans from the cheap regex are now validated against a TLD set directly, picking the rightmost TLD that leaves ≥1 preceding label. The domain_name grammar is still used as a sub-grammar inside email/url/xmpp parsers, where its inner label loop has been collapsed into a single Regex (replacing the OneOrMore(label + "." + FollowedBy(...)) construction).
• The scheme_less_url and scheme_less_url_complete grammars no longer also match URLs with a scheme; they only match URLs without one (#244). parse_urls and parse_urls_complete now run the scheme-ful grammar first and mask each matched URL before running the scheme-less grammar, so user-facing output of find_iocs is unchanged but embedded scheme-less hosts inside a scheme-ful URL's query (e.g. https://shortener.com/?url=foo.com/bar) no longer surface as a second URL.

Fixed

• urls_complete now accepts @ in URL paths, matching the RFC 3986 pchar definition (e.g. https://example.com/users/@alice is now captured in full).
• parse_user_agents no longer absorbs a trailing token like TLP from input such as Mozilla/4.0 (...) TLP:RED. A bare (version-less) platform token must not be immediately followed by :. Versioned platforms (e.g. Chrome/91.0) are unaffected. (#227)

Added

• New socket_addresses IOC type with a matching parse_socket_addresses helper (#248). Accepts ipv4:port and bracketed [ipv6]:port shapes with a 1..65535 port range. IPv6 host validation reuses the existing _is_valid_ipv6 helper so the same shortened forms accepted by parse_ipv6_addresses are accepted here too. Observed text is preserved verbatim (no leading-zero normalization). Port 0 is intentionally excluded as IANA-reserved.
• New ipv6_cidrs IOC type with a matching parse_ipv6_cidrs helper (#121). It accepts the same shortened/::/trailing-:: forms as the existing IPv6 address parser plus a /0..128 bit range, and integrates with the existing CIDR-vs-URL and parse_address_from_cidr handling. CIDR parsing runs against the pre-fang text so the standard fanger (which rewrites ::/ to ://) cannot silently swallow indicators like 2001:db8::/32.
• Added structured logging throughout the library using the standard logging module (#287). The package follows the standard library convention of attaching a NullHandler so consumers see no output unless they configure logging. find_iocs emits INFO at start/finish (text length, IOC type count), WARNING when unsupported types are passed via included_ioc_types (they are now ignored rather than silently treated as misses), and DEBUG for per-type result counts and lower-level transforms (text fanging, URL cleaning). Apps can opt in with e.g. logging.getLogger("ioc_finder").setLevel(logging.DEBUG).

[9.2.0] - 2026.04.30

Added

• Added regex prefiltering to all observable types (both default and non-default)

Changed (Internal)

• Switched fully over to UV.
  • Changed Dependabot to the uv ecosystem so pyproject.toml and uv.lock are updated atomically.
  • Removed the generated requirements.txt / requirements_dev.txt compatibility exports and the make export-requirements target. Contributors should use uv sync --locked --group dev to set up a dev environment.

[9.1.1] - 2026.04.29

Fixed

... (truncated)

Commits

• 0679248 Release version 9.4.1
• ab74add Bump ioc-fanger floor to 5.1.1
• 3fb4185 Fix quadratic-time ReDoS in email candidate scanning (#389)
• 20d2809 Bump ioc-fanger from 5.0.0 to 5.1.0 (#386)
• 953b93f Merge branch 'main' of github.com:fhightower/ioc-finder
• b1e1182 New version
• bd31645 Bump hypothesis from 6.155.1 to 6.155.2 (#387)
• 4ccd6fa Bump ruff from 0.15.15 to 0.15.16 (#388)
• 8cb889c Add parse_unicode_iocs option for Unicode domain labels (#298) (#366)
• 2130865 Bump hypothesis from 6.153.6 to 6.155.1 (#384)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)