PYSEC-2026-4223 Hydra instantiate target blacklist bypasses permit code execution

Summary Hydra's instantiate API resolves and invokes Python callables named by the target field in configuration. The target blacklist introduced for CVE-2026-68508 was incomplete. Representative bypasses included execution wrappers such as timeit.timeit, executable deserialization through...