[dependabot]

Bumps the elixir-mcp-server group with 4 updates in the /apps/mcp-server-elixir directory: bandit, hackney, phoenix_pubsub and tesla.

Updates bandit from 1.12.5 to 1.13.1

Changelog

Sourced from bandit's changelog.

1.13.1 (15 Oct 2026)

Reverts

• Revert the stale conn check added in 1.13.0 (#668), since a number of valid code paths in Phoenix depend on stale conns (notably, Plug.Parsers errors rendered by Phoenix.Endpoint.RenderErrors). See elixir-plug/plug#1331

1.13.0 (15 Oct 2026)

Enhancements

• Add a compress_chunked option to compress chunked responses with gzip and zstd (#707, thanks @​iStefo!)
• Clarify inet6 option behaviour on dual-stack platforms (#709, #700, thanks @​adelton!)
• Unroll WebSocket masking over 32-byte blocks (#674, thanks @​mpettibone!)
• Drain HTTP/2 pending sends without repeated List.delete/2 (#673, thanks @​mpettibone!)
• Short-circuit header token lookup on the first match (#699, thanks @​claytongentry!)
• Scope the workflow tokens to what each job actually uses (#702, thanks @​Totara-thib!)
• Add a Plumber check and score badge (#712, thanks @​Totara-thib!)
• Fix recent releases changelog headings in docs (#672, thanks @​dinokovac-river!)

Changes

• Require Thousand Island 1.6, and use the peername it now captures when it accepts a connection (#718)
• Require hpax 1.1 and drop the nil field value workaround (#706, thanks @​acrogenesis!)
• Report conn.port as an integer for CONNECT requests, as Plug.Conn requires
• Close idle connections which send no bytes silently instead of answering 408 (#689, thanks @​tomciopp!)
• RFC Conformance: Enforce Host requirements for HTTP/1.1 targets (#679, thanks @​mpettibone!)
• RFC Conformance: Complete HTTP/2 field validation (#680, thanks @​mpettibone!)
• RFC Conformance: Validate HTTP/2 content length on initial END_STREAM (#681, thanks @​mpettibone!)
• RFC Conformance: Enforce HTTP/2 trailer field section requirements (#682, thanks @​mpettibone!)
• RFC Conformance: Validate request transfer coding before Plug dispatch (#683, thanks @​mpettibone!)
• RFC Conformance: Fix HTTP/1.0 streaming response framing (#684, thanks @​mpettibone!)
• RFC Conformance: Accept empty non-final WebSocket continuation frames (#685, thanks @​mpettibone!)
• RFC Conformance: Validate WebSocket client keys (#686, thanks @​mpettibone!)

Fixes

• Validate the authority of HTTP/1 absolute-form and authority-form request targets against the same grammar as the Host header (GHSA-v53v-9hvg-37jf, thanks @​euriconicacio!)
• Bound HTTP/2 sends blocked on a send window by progress, so that a trickle of window updates can no longer keep a stream pinned indefinitely (GHSA-69m6-wcv4-rwcf, thanks @​tomciopp!)
• Reject control bytes in HTTP/1 request targets (#713, #711, thanks @​PJUllrich!)
• Fix crash when a client resets an HTTP/1 connection before Bandit reads its peer address (#718, #717, thanks @​mhsdef!)
• Drain all queued HTTP/2 DATA frames of an unread body once a response has been sent (#710, #697, thanks @​jamilbk!)
• Preserve independent error responses on HTTP/1 keep-alive and pipelined requests, and frame empty 4xx/5xx error responses with Content-Length: 0 (#705, thanks @​jeregrine!)
• Close instead of draining when a plug never honors Expect: 100-continue (#695, thanks @​tomciopp!)
• Fix chunked read_body(length: 0) falsely completing the body (#691, thanks @​tomciopp!)
• Observe RST_STREAM while blocked on the stream send window (#688, thanks @​tomciopp!)

... (truncated)

Commits

• ee75d31 Version bump to 1.13.1
• 84e9d1d Revert "Guard against stale conn reuse in Bandit.Adapter (#668)" (#719)
• d6daa4a Version bump to 1.13.0
• 02a3853 Add a Plumber check and score badge (#712)
• 0c53a6e Require Thousand Island 1.6 and use its cached peername (#718)
• 8993dae Bump finch from 0.21.0 to 0.24.0 (#716)
• 6ea8021 Merge commit from fork
• 2758910 Bump req from 0.7.4 to 0.7.5 (#715)
• 70014a0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#714)
• c95938d Reject control bytes in HTTP/1 request targets (#713)
• Additional commits viewable in compare view

Updates hackney from 4.8.4 to 4.8.5

Release notes

Sourced from hackney's releases.

hackney 4.8.5

Fixed

• A GOAWAY fails only the requests the server refused. HTTP/2 failed every in-flight request with {error, {goaway, _}}, including ones the server went on to complete, and HTTP/3 ignored the GOAWAY and kept sending new requests on the connection. Accepted streams now finish, streamed uploads and responses included, refused ones fail and are reset, and the connection leaves the pool and closes once drained (#961, #962, #964, #965, #968).
• A failed HTTP/2 request body send fails the other streams on the connection instead of leaving them waiting (#964).
• Closing an HTTP/3 connection no longer makes the other live HTTP/3 connections unreachable. The connection table was owned by the first connection and went away with it (#967).

Changed

• Update h2 to 0.12.4, quic to 2.1.1 and webtransport to 0.4.8.

Changelog

Sourced from hackney's changelog.

4.8.5 - 2026-10-04

Fixed

• A GOAWAY fails only the requests the server refused. HTTP/2 failed every in-flight request with {error, {goaway, _}}, including ones the server went on to complete, and HTTP/3 ignored the GOAWAY and kept sending new requests on the connection. Accepted streams now finish, streamed uploads and responses included, refused ones fail and are reset, and the connection leaves the pool and closes once drained (#961, #962, #964, #965, #968).
• A failed HTTP/2 request body send fails the other streams on the connection instead of leaving them waiting (#964).
• Closing an HTTP/3 connection no longer makes the other live HTTP/3 connections unreachable. The connection table was owned by the first connection and went away with it (#967).

Changed

• Update h2 to 0.12.4, quic to 2.1.1 and webtransport to 0.4.8.

Commits

• f915bba Merge pull request #969 from benoitc/release/4.8.5
• 4962e54 Release 4.8.5
• dff0d5f Merge pull request #968 from benoitc/fix/h3-goaway-drain
• ca03c3c Drain an HTTP/3 connection on GOAWAY
• 8957485 Merge pull request #967 from benoitc/fix/h3-conn-table-owner
• 978be5e Merge pull request #966 from benoitc/deps/webtransport-0.4.8
• b3a892a Create the HTTP/3 connection table in hackney_sup
• 2371345 Bump webtransport to 0.4.8
• 2cf1c1b Merge pull request #965 from benoitc/fix/h2-goaway-rst-refused
• a6e9746 Reset the streams a GOAWAY refuses
• Additional commits viewable in compare view

Updates phoenix_pubsub from 2.3.0 to 2.4.1

Changelog

Sourced from phoenix_pubsub's changelog.

2.4.1 (2026-10-08)

Enhancements

• Add c:Phoenix.PubSub.Sender.finalize/1 as optional callback

2.4.0 (2026-10-07)

Enhancements

• Add Phoenix.PubSub.Sender as a successor for custom dispatchers
• Add Phoenix.PubSub.unsubscribe_sender/3 to selectively remove sender subscriptions

Migrating custom dispatchers

Custom dispatchers and the :metadata subscription option are deprecated in favor of per-subscription senders. Existing dispatchers continue to work, except that subscribing with :metadata in the shape of [atom | term] now raises. That shape is reserved for senders.

To migrate:

1. Implement the Phoenix.PubSub.Sender behaviour in your delivery module. Its send/4 callback receives one subscriber pid, its metadata, the message, and an accumulator. Move the delivery logic from dispatch/3 into this callback. PubSub handles iterating over subscribers and excluding the originating pid for broadcast_from calls.

2. Replace metadata: metadata in subscriptions with sender: {MySender, metadata}:

   Phoenix.PubSub.subscribe(MyApp.PubSub, "topic", sender: {MySender, metadata})

3. Remove custom dispatcher arguments from broadcast calls and remove the :dispatcher option from your PubSub child specification to use the default Phoenix.PubSub dispatcher. Custom dispatchers control delivery themselves and do not automatically invoke senders, so changing subscriptions alone is not sufficient.

4. Replace unsubscribe_match/3 calls for migrated subscriptions with unsubscribe_sender/3, passing the same sender tuple:

   Phoenix.PubSub.unsubscribe_sender(MyApp.PubSub, "topic", {MySender, metadata})

Commits

• 79d97f0 update changelog
• 904731e Release v2.4.1
• cf2c8a0 Add finalize to sender behaviour (#220)
• 43688f7 Update docs
• 9134531 Release v2.4.0
• 76f64f9 Merge pull request #219 from phoenixframework/sd-sender-2
• be1aa34 add note about reserved metadata shape and re-add guards
• 1527c10 use OTP 29 for main, fmt
• 5b81eae add Elixir 1.20 + OTP 29 to CI
• 12ff0ef check formatter in CI
• Additional commits viewable in compare view

Updates tesla from 1.21.3 to 1.22.0

Release notes

Sourced from tesla's releases.

v1.22.0

1.22.0 (2026-10-04)

Features

• Add Tesla.SecretString to keep secrets out of inspect output (#939) (258d378)

Changelog

Sourced from tesla's changelog.

1.22.0 (2026-10-04)

Features

• Add Tesla.SecretString to keep secrets out of inspect output (#939) (258d378)

Commits

• 971adcd chore(master): release 1.22.0 (#943)
• aaf6ba5 chore(deps): bump hackney from 4.7.4 to 4.8.2 in the prod group (#947)
• f1d040b chore(coverage): stop adapter coverage from depending on packet timing (#946)
• 8d0ee3a chore(deps): bump mint from 1.10.0 to 1.10.1 in the prod group across 1 direc...
• 2dd5448 chore: stop depending on httparrot's expiring TLS certificate (#945)
• 258d378 feat: add Tesla.SecretString to keep secrets out of inspect output (#939)
• 467ef74 chore(deps): bump the prod group with 3 updates (#941)
• 9f10322 chore(deps): bump the dev group with 4 updates (#942)
• 10a51c6 chore(deps): bump mox from 1.2.0 to 1.3.0 in the prod group (#940)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions