[dependabot]

Bumps the elixir-query-service group with 5 updates in the /apps/query-service directory:

Package	From	To
bandit	1.12.5	1.13.1
broadway_kafka	0.7.0	0.7.1
hackney	4.8.4	4.8.5
req	0.7.4	0.7.5
tesla	1.21.3	1.22.0

Updates bandit from 1.12.5 to 1.13.1

Changelog

Sourced from bandit's changelog.

1.13.1 (15 Oct 2026)

Reverts

• Revert the stale conn check added in 1.13.0 (#668), since a number of valid code paths in Phoenix depend on stale conns (notably, Plug.Parsers errors rendered by Phoenix.Endpoint.RenderErrors). See elixir-plug/plug#1331

1.13.0 (15 Oct 2026)

Enhancements

• Add a compress_chunked option to compress chunked responses with gzip and zstd (#707, thanks @​iStefo!)
• Clarify inet6 option behaviour on dual-stack platforms (#709, #700, thanks @​adelton!)
• Unroll WebSocket masking over 32-byte blocks (#674, thanks @​mpettibone!)
• Drain HTTP/2 pending sends without repeated List.delete/2 (#673, thanks @​mpettibone!)
• Short-circuit header token lookup on the first match (#699, thanks @​claytongentry!)
• Scope the workflow tokens to what each job actually uses (#702, thanks @​Totara-thib!)
• Add a Plumber check and score badge (#712, thanks @​Totara-thib!)
• Fix recent releases changelog headings in docs (#672, thanks @​dinokovac-river!)

Changes

• Require Thousand Island 1.6, and use the peername it now captures when it accepts a connection (#718)
• Require hpax 1.1 and drop the nil field value workaround (#706, thanks @​acrogenesis!)
• Report conn.port as an integer for CONNECT requests, as Plug.Conn requires
• Close idle connections which send no bytes silently instead of answering 408 (#689, thanks @​tomciopp!)
• RFC Conformance: Enforce Host requirements for HTTP/1.1 targets (#679, thanks @​mpettibone!)
• RFC Conformance: Complete HTTP/2 field validation (#680, thanks @​mpettibone!)
• RFC Conformance: Validate HTTP/2 content length on initial END_STREAM (#681, thanks @​mpettibone!)
• RFC Conformance: Enforce HTTP/2 trailer field section requirements (#682, thanks @​mpettibone!)
• RFC Conformance: Validate request transfer coding before Plug dispatch (#683, thanks @​mpettibone!)
• RFC Conformance: Fix HTTP/1.0 streaming response framing (#684, thanks @​mpettibone!)
• RFC Conformance: Accept empty non-final WebSocket continuation frames (#685, thanks @​mpettibone!)
• RFC Conformance: Validate WebSocket client keys (#686, thanks @​mpettibone!)

Fixes

• Validate the authority of HTTP/1 absolute-form and authority-form request targets against the same grammar as the Host header (GHSA-v53v-9hvg-37jf, thanks @​euriconicacio!)
• Bound HTTP/2 sends blocked on a send window by progress, so that a trickle of window updates can no longer keep a stream pinned indefinitely (GHSA-69m6-wcv4-rwcf, thanks @​tomciopp!)
• Reject control bytes in HTTP/1 request targets (#713, #711, thanks @​PJUllrich!)
• Fix crash when a client resets an HTTP/1 connection before Bandit reads its peer address (#718, #717, thanks @​mhsdef!)
• Drain all queued HTTP/2 DATA frames of an unread body once a response has been sent (#710, #697, thanks @​jamilbk!)
• Preserve independent error responses on HTTP/1 keep-alive and pipelined requests, and frame empty 4xx/5xx error responses with Content-Length: 0 (#705, thanks @​jeregrine!)
• Close instead of draining when a plug never honors Expect: 100-continue (#695, thanks @​tomciopp!)
• Fix chunked read_body(length: 0) falsely completing the body (#691, thanks @​tomciopp!)
• Observe RST_STREAM while blocked on the stream send window (#688, thanks @​tomciopp!)

... (truncated)

Commits

• ee75d31 Version bump to 1.13.1
• 84e9d1d Revert "Guard against stale conn reuse in Bandit.Adapter (#668)" (#719)
• d6daa4a Version bump to 1.13.0
• 02a3853 Add a Plumber check and score badge (#712)
• 0c53a6e Require Thousand Island 1.6 and use its cached peername (#718)
• 8993dae Bump finch from 0.21.0 to 0.24.0 (#716)
• 6ea8021 Merge commit from fork
• 2758910 Bump req from 0.7.4 to 0.7.5 (#715)
• 70014a0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#714)
• c95938d Reject control bytes in HTTP/1 request targets (#713)
• Additional commits viewable in compare view

Updates broadway_kafka from 0.7.0 to 0.7.1

Changelog

Sourced from broadway_kafka's changelog.

v0.7.1 (2026-10-15)

• Stop a non-shared :brod client that went down when the producer terminates. Before, the client stayed registered in :brod, and restarting the producer failed with {:error, :already_present}. This helps a lot in tests, especially.

Commits

• dedd507 Release v0.7.1
• e20a492 Test oldest and newest supported Elixir and OTP versions (#177)
• 25200b8 Stop a non-shared client that went down on terminate (#176)
• See full diff in compare view

Updates hackney from 4.8.4 to 4.8.5

Release notes

Sourced from hackney's releases.

hackney 4.8.5

Fixed

• A GOAWAY fails only the requests the server refused. HTTP/2 failed every in-flight request with {error, {goaway, _}}, including ones the server went on to complete, and HTTP/3 ignored the GOAWAY and kept sending new requests on the connection. Accepted streams now finish, streamed uploads and responses included, refused ones fail and are reset, and the connection leaves the pool and closes once drained (#961, #962, #964, #965, #968).
• A failed HTTP/2 request body send fails the other streams on the connection instead of leaving them waiting (#964).
• Closing an HTTP/3 connection no longer makes the other live HTTP/3 connections unreachable. The connection table was owned by the first connection and went away with it (#967).

Changed

• Update h2 to 0.12.4, quic to 2.1.1 and webtransport to 0.4.8.

Changelog

Sourced from hackney's changelog.

4.8.5 - 2026-10-04

Fixed

• A GOAWAY fails only the requests the server refused. HTTP/2 failed every in-flight request with {error, {goaway, _}}, including ones the server went on to complete, and HTTP/3 ignored the GOAWAY and kept sending new requests on the connection. Accepted streams now finish, streamed uploads and responses included, refused ones fail and are reset, and the connection leaves the pool and closes once drained (#961, #962, #964, #965, #968).
• A failed HTTP/2 request body send fails the other streams on the connection instead of leaving them waiting (#964).
• Closing an HTTP/3 connection no longer makes the other live HTTP/3 connections unreachable. The connection table was owned by the first connection and went away with it (#967).

Changed

• Update h2 to 0.12.4, quic to 2.1.1 and webtransport to 0.4.8.

Commits

• f915bba Merge pull request #969 from benoitc/release/4.8.5
• 4962e54 Release 4.8.5
• dff0d5f Merge pull request #968 from benoitc/fix/h3-goaway-drain
• ca03c3c Drain an HTTP/3 connection on GOAWAY
• 8957485 Merge pull request #967 from benoitc/fix/h3-conn-table-owner
• 978be5e Merge pull request #966 from benoitc/deps/webtransport-0.4.8
• b3a892a Create the HTTP/3 connection table in hackney_sup
• 2371345 Bump webtransport to 0.4.8
• 2cf1c1b Merge pull request #965 from benoitc/fix/h2-goaway-rst-refused
• a6e9746 Reset the streams a GOAWAY refuses
• Additional commits viewable in compare view

Updates req from 0.7.4 to 0.7.5

Release notes

Sourced from req's releases.

v0.7.5

• put_aws_sigv4: Fix SigV4 signing on retries.
• redirect: Change method to GET (except HEAD) on HTTP 303. Thanks to @​euriconicacio for reporting this.

Changelog

Sourced from req's changelog.

v0.7.5 (2026-10-06)

• [put_aws_sigv4]: Fix SigV4 signing on retries.
• [redirect]: Change method to GET (except HEAD) on HTTP 303.

Commits

• 2ce74f1 Release v0.7.5
• 10c7414 Fix connect timeout test
• 331c5d9 Fix SigV4 signing on retries
• bd18cb2 redirect: Change method to GET (except HEAD) on HTTP 303
• See full diff in compare view

Updates tesla from 1.21.3 to 1.22.0

Release notes

Sourced from tesla's releases.

v1.22.0

1.22.0 (2026-10-04)

Features

• Add Tesla.SecretString to keep secrets out of inspect output (#939) (258d378)

Changelog

Sourced from tesla's changelog.

1.22.0 (2026-10-04)

Features

• Add Tesla.SecretString to keep secrets out of inspect output (#939) (258d378)

Commits

• 971adcd chore(master): release 1.22.0 (#943)
• aaf6ba5 chore(deps): bump hackney from 4.7.4 to 4.8.2 in the prod group (#947)
• f1d040b chore(coverage): stop adapter coverage from depending on packet timing (#946)
• 8d0ee3a chore(deps): bump mint from 1.10.0 to 1.10.1 in the prod group across 1 direc...
• 2dd5448 chore: stop depending on httparrot's expiring TLS certificate (#945)
• 258d378 feat: add Tesla.SecretString to keep secrets out of inspect output (#939)
• 467ef74 chore(deps): bump the prod group with 3 updates (#941)
• 9f10322 chore(deps): bump the dev group with 4 updates (#942)
• 10a51c6 chore(deps): bump mox from 1.2.0 to 1.3.0 in the prod group (#940)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions