chore(deps): bump the production-dependencies group with 3 updates

[dependabot]

Bumps the production-dependencies group with 3 updates: igniter, req and spark.

Updates igniter from 0.8.1 to 0.8.2

Release notes

Sourced from igniter's releases.

v0.8.2

Bug Fixes:

• handle empty list in configures_key by Zach Daniel

Improvements:

• Add scoped configure/6 options for runtime env blocks (#385) by RhettPoole

• Send issue output to stderr (#384) by daphnerosepurcell

• allow remapping modules to their file locations w/ regexes (#378) by aheiner2001

• add --except to igniter.upgrade --all (#383) by febarnett3

• intercept --help for igniter.new and other tasks. (#382) by CaydenLords

Changelog

Sourced from igniter's changelog.

v0.8.2 (2026-06-24)

Bug Fixes:

• handle empty list in configures_key by Zach Daniel

Improvements:

• Add scoped configure/6 options for runtime env blocks (#385) by RhettPoole

• Send issue output to stderr (#384) by daphnerosepurcell

• allow remapping modules to their file locations w/ regexes (#378) by aheiner2001

• add --except to igniter.upgrade --all (#383) by febarnett3

• intercept --help for igniter.new and other tasks. (#382) by CaydenLords

Commits

• 0625839 chore: release version v0.8.2
• 021a000 fix: handle empty list in configures_key
• c2a3521 chore: fix test ordering issue
• a060158 chore: format
• 168f64f improvement: Add scoped configure/6 options for runtime env blocks (#385)
• 200d237 improvement: Send issue output to stderr (#384)
• 549e01c improvement: allow remapping modules to their file locations w/ regexes (#378)
• bc3edcd improvement: add --except to igniter.upgrade --all (#383)
• caa4134 improvement: intercept --help for igniter.new and other tasks. (#382)
• b7fb1fc build(deps): bump the production-dependencies group across 1 directory with 4...
• Additional commits viewable in compare view

Updates req from 0.5.18 to 0.6.2

Release notes

Sourced from req's releases.

v0.6.1

• compressed, decompress_body: Disable automatic decompression

  Decompression is now opt-in by setting compressed: true.

v0.6.0

• encode_body: Security fix for :form_multipart header injection (GHSA-px9f-whj3-246m).

  The multipart encoder interpolated the per-part name, filename, and content_type into the part headers without escaping, so an attacker-controlled value could inject extra headers or smuggle additional parts into the request. These values are now escaped per RFC 7578 / WHATWG form-data (", CR, and LF are percent-encoded).

  Thanks to @​PJUllrich for reporting it.

• decode_body: Drop automatic zip/tar/tgz/gz/zst/csv decoding, (GHSA-655f-mp8p-96gv).

  Req previously auto-decoded archive and compressed response bodies (zip, tar, tgz, gz, zst, and csv) based on the server-supplied content-type, materialising the full decompressed contents in memory with no size cap. An attacker-controlled (or redirect-reachable) endpoint could return a tiny "decompression bomb" that expanded to gigabytes and exhausted the node's memory.

  Now only JSON is decoded by default. Other formats are opt-in via the new :decoders option, which defaults to [:json, :json_api]. Setting it replaces the default (include :json to keep JSON decoding), and false disables all decoding:

  # opt into archives (only for endpoints you trust):
  Req.get!(url, decoders: [:json, :zip])
  

  Note: The decoded zip/tar is still list of {filename :: charlist(), contents :: binary} tuples. In the future release, this will be list of {filename :: binary(), contents :: binary()} tuples.

  While automatic CSV decoding wasn't a security issue, the behaviour based on presence/absence of nimble_csv dependency was suprising. CSV support is still built-in but need to be enabled with decoders: [:csv].

... (truncated)

Changelog

Sourced from req's changelog.

v0.6.2 (2026-06-19)

• Use finch ~> 0.21.

v0.6.1 (2026-06-08)

• [compressed], [decompress_body]: Disable automatic decompression

  Decompression is now opt-in by setting compressed: true.

v0.6.0 (2026-06-08)

• [encode_body]: Security fix for :form_multipart header injection (GHSA-px9f-whj3-246m).

  The multipart encoder interpolated the per-part name, filename, and content_type into the part headers without escaping, so an attacker-controlled value could inject extra headers or smuggle additional parts into the request. These values are now escaped per RFC 7578 / WHATWG form-data (", CR, and LF are percent-encoded).

  Thanks to @​PJUllrich for reporting it.

• [decode_body]: Drop automatic zip/tar/tgz/gz/zst/csv decoding, (GHSA-655f-mp8p-96gv).

  Req previously auto-decoded archive and compressed response bodies (zip, tar, tgz, gz, zst, and csv) based on the server-supplied content-type, materialising the full decompressed contents in memory with no size cap. An attacker-controlled (or redirect-reachable) endpoint could return a tiny "decompression bomb" that expanded to gigabytes and exhausted the node's memory.

  Now only JSON is decoded by default. Other formats are opt-in via the new :decoders option, which defaults to [:json, :json_api]. Setting it replaces the default (include :json to keep JSON decoding), and false disables all decoding:

  # opt into archives (only for endpoints you trust):
  Req.get!(url, decoders: [:json, :zip])
  

  Note: The decoded zip/tar is still list of {filename :: charlist(), contents :: binary} tuples. In the future release, this will be list of {filename :: binary(), contents :: binary()} tuples.

  While automatic CSV decoding wasn't a security issue, the behaviour based on presence/absence of nimble_csv dependency was suprising. CSV support is still built-in but need to be enabled with decoders: [:csv].

... (truncated)

Commits

• f2c833c Release v0.6.2
• f082be9 Use finch ~> 0.21
• 36a8252 Release v0.6.1
• ea5506f compressed, decompress_body: Disable automatic decompression
• 8e7425f Release v0.6.0
• 584a490 decode_body: Drop automatic zip/tar/tgz/gz/zst/csv decoding
• 2d77dbe encode_body: Security fix for :form_multipart header injection
• See full diff in compare view

Updates spark from 2.7.0 to 2.7.2

Release notes

Sourced from spark's releases.

v2.7.1

Bug Fixes:

• fix elixir 1.20 warning by Zach Daniel

• resolve Elixir 1.20 compilation warnings (#278) by Gilbert

Changelog

Sourced from spark's changelog.

v2.7.2 (2026-06-07)

Bug Fixes:

• revert pmap introduction (#282) by nxy7

v2.7.1 (2026-06-05)

Bug Fixes:

• fix elixir 1.20 warning by Zach Daniel

• resolve Elixir 1.20 compilation warnings (#278) by Gilbert

Commits

• 5c28073 chore: release version v2.7.2
• 60985df fix: revert pmap introduction (#282)
• 614e6cf chore: release version v2.7.1
• b6da465 fix: fix elixir 1.20 warning
• 35bd143 chore(deps): bump igniter from 0.7.9 to 0.8.1 (#281)
• 33338cd chore(deps): bump jason from 1.4.4 to 1.4.5 (#280)
• e7ff5cd chore(deps-dev): bump ex_doc from 0.40.1 to 0.40.3 (#279)
• 334a1ff fix: resolve Elixir 1.20 compilation warnings (#278)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions