build(deps): bump pyspnego from 0.12.2 to 0.12.4 in /lockfiles/py313-windows

[dependabot]

Bumps pyspnego from 0.12.2 to 0.12.4.

Release notes

Sourced from pyspnego's releases.

v0.12.4

0.12.4 - 2026-10-06

• Fix SSPI acceptor with explicit Password or KerberosKeytab credentials failing with SEC_E_LOGON_DENIED when the username is in the UPN form user@REALM
  • The pszPrincipal value is no longer passed to AcquireCredentialsHandle, it was set to the SPN for acceptors but does not control the acceptor identity
• Fix spnego.server(credentials=..., protocol="negotiate", options=NegotiateOptions.use_negotiate) to pass the credentials to the Kerberos and NTLM acceptor contexts it creates
  • On Windows the Kerberos acceptor had no credential to accept with and was dropped from the mech list, leaving only NTLM
• Fix SPNEGO acceptor to echo the Kerberos OID the initiator offered as the supportedMech
  • Windows initiators list the MS Kerberos OID 1.2.840.48018.1.2.2 ahead of the standard OID and reject a NegTokenResp that does not echo it
  • The MS Kerberos OID and the pre RFC draft OID 1.3.5.1.5.2 are treated as aliases of Kerberos when matching the mech list and supportedMech, matching MIT krb5
  • The acceptor no longer requests a mechListMIC when the initiator listed a Kerberos alias first as the optimistic mech was the one selected
• Use socket.gethostname() rather than socket.getfqdn() for the DnsComputerName in the NTLM acceptor CHALLENGE message
  • socket.getfqdn() does a DNS lookup which can block for a few seconds when DNS is not set up for the host
• Fix the SSPI negotiated_protocol and session_key properties failing with a TypeError before the first step
  • negotiated_protocol returns the protocol requested, or None for negotiate, like the GSSAPI and Python Negotiate proxies
  • session_key raises NoContextError like the GSSAPI proxy

What's Changed

• Bump version after release by @​jborean93 in jborean93/pyspnego#111
• Fix up some SSPI interop by @​jborean93 in jborean93/pyspnego#112
• Migrate to Obol KDC in tests by @​jborean93 in jborean93/pyspnego#113

Full Changelog: jborean93/pyspnego@v0.12.3...v0.12.4

v0.12.3

0.12.3 - 2026-09-30

• Fix NTLM acceptor to include the Version field in the CHALLENGE message when NTLMSSP_NEGOTIATE_VERSION is negotiated
  • Strict initiators like gss-ntlmssp failed to decode the message as the field offsets were 8 bytes too early

What's Changed

• Bump version after release and remove intel macOS runners by @​jborean93 in jborean93/pyspnego#108
• Fix NTLM Challenge version handling by @​jborean93 in jborean93/pyspnego#110

Full Changelog: jborean93/pyspnego@v0.12.2...v0.12.3

Changelog

Sourced from pyspnego's changelog.

0.12.4 - 2026-10-06

• Fix SSPI acceptor with explicit Password or KerberosKeytab credentials failing with SEC_E_LOGON_DENIED when the username is in the UPN form user@REALM
  • The pszPrincipal value is no longer passed to AcquireCredentialsHandle, it was set to the SPN for acceptors but does not control the acceptor identity
• Fix spnego.server(credentials=..., protocol="negotiate", options=NegotiateOptions.use_negotiate) to pass the credentials to the Kerberos and NTLM acceptor contexts it creates
  • On Windows the Kerberos acceptor had no credential to accept with and was dropped from the mech list, leaving only NTLM
• Fix SPNEGO acceptor to echo the Kerberos OID the initiator offered as the supportedMech
  • Windows initiators list the MS Kerberos OID 1.2.840.48018.1.2.2 ahead of the standard OID and reject a NegTokenResp that does not echo it
  • The MS Kerberos OID and the pre RFC draft OID 1.3.5.1.5.2 are treated as aliases of Kerberos when matching the mech list and supportedMech, matching MIT krb5
  • The acceptor no longer requests a mechListMIC when the initiator listed a Kerberos alias first as the optimistic mech was the one selected
• Use socket.gethostname() rather than socket.getfqdn() for the DnsComputerName in the NTLM acceptor CHALLENGE message
  • socket.getfqdn() does a DNS lookup which can block for a few seconds when DNS is not set up for the host
• Fix the SSPI negotiated_protocol and session_key properties failing with a TypeError before the first step
  • negotiated_protocol returns the protocol requested, or None for negotiate, like the GSSAPI and Python Negotiate proxies
  • session_key raises NoContextError like the GSSAPI proxy

0.12.3 - 2026-09-30

• Fix NTLM acceptor to include the Version field in the CHALLENGE message when NTLMSSP_NEGOTIATE_VERSION is negotiated
  • Strict initiators like gss-ntlmssp failed to decode the message as the field offsets were 8 bytes too early

Commits

• 133ec00 Migrate to Obol KDC in tests (#113)
• db73fdb Fix up some SSPI interop (#112)
• 22b699a Bump version after release (#111)
• 9de53df Fix NTLM Challenge version handling (#110)
• f13a172 Bump version after release and remove intel macOS runners (#108)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)