Skip to content

chore(deps): bump the all-dependencies group with 9 updates - #7

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/all-dependencies-361dc3f8a0
Closed

chore(deps): bump the all-dependencies group with 9 updates#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/all-dependencies-361dc3f8a0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the all-dependencies group with 9 updates:

Package From To
bandit 1.12.0 1.12.5
dialyxir 1.4.7 1.4.8
ex_doc 0.40.3 0.40.4
igniter 0.8.2 0.8.4
mimic 2.3.0 2.4.0
quiver 0.4.0 0.4.1
sycophant 0.5.0 0.5.1
tidewave 0.8.0 0.9.0
usage_rules 1.2.6 1.2.8

Updates bandit from 1.12.0 to 1.12.5

Changelog

Sourced from bandit's changelog.

1.12.5 (20 Aug 2026)

Changes

  • Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532w-jv94) (#671)
  • Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings (#665)
  • Treat proxy-connection as a connection-specific header in HTTP/2 (#632)
  • Return FRAME_SIZE_ERROR for HEADERS/DATA frames too short for their flags (#652)
  • Treat abortive-close posix reasons as client closures in logging (#663)

Fixes

  • Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) (#670)
  • Use PROTOCOL_ERROR for a zero WINDOW_UPDATE increment (#656)
  • Reject send_file ranges past EOF instead of emitting a negative Content-Length (#653)
  • Reject compressed WebSocket control frames regardless of the fin bit (#651)
  • Enforce the RFC9112 chunk-size grammar and reject repeated transfer-encoding (#631)
  • Fix typos (#627)
  • Fix non-deterministic compile-time code (#646)

Enhancements

  • Lazily precompile the invalid-field-value match pattern (#662)
  • Add tests for untested configuration options (#659)
  • Match the weak-etag prefix W/ explicitly (#657)
  • Do not duplicate an existing vary: accept-encoding header (#658)
  • Honor the close/keep-alive token inside a comma-separated Connection header (#655)
  • Initialize the per-stream receive window from the advertised initial_window_size (#654)
  • Keep track of body_length to avoid list iterations (#645)
  • Avoid per-header length/1 and option lookups in do_read_headers! (#614) (#626)

1.12.4 (27 July 2026)

Fixes

  • Properly send Connection: close header when client requests closure (#617)
  • Disallow transfer-encoding on HTTP/1.0 connections (#618)
  • Reject requests with multiple Host headers (#619)
  • Reject malformed header lines (#620)
  • Fix handling of chunk extensions (#621)

Enhancements

  • Tighten up CI against supply chain attacks (#623, thanks @​Totara-thib!)
  • Reorganize and increase coverage of HTTP/1 tests to better match RFC structure (#616)
  • Tolerate a leading newline on HTTP/1 requests (#622)
  • Send "100 Continue" interim response before reading body if client requests it (#624)

1.12.3 (25 July 2026)

... (truncated)

Commits
  • 9571499 Version bump to 1.12.5
  • f6914aa Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532...
  • d38cf04 Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) (#670)
  • cce7c5f Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings (#...
  • eca1713 Fixup recent test noise
  • b65c235 Consolidate Plug.Conn.Adapter calling-process tests into adapter_test.exs (#667)
  • 4ccc008 Treat abortive-close posix reasons as client closures in logging (#663)
  • 274eb55 Lazily precompile the invalid-field-value match pattern (#662)
  • 10710de Enforce the chunk-size grammar in a single pass (#661)
  • d69202e Unify case-insensitive comma-separated header token checks (#660)
  • Additional commits viewable in compare view

Updates dialyxir from 1.4.7 to 1.4.8

Release notes

Sourced from dialyxir's releases.

1.4.8

Added

  • Add support for the OTP 28 warnings :exact_compare, :opaque_compare, and :opaque_union.

Fixed

  • Handle line-and-column locations when matching line-specific warning ignores.

Changed

  • Update ExDoc to 0.40.3 to generate Markdown documentation and llms.txt.

Docs

  • Clarify the output and intended use of the ignore_file and ignore_file_strict formatters.
Changelog

Sourced from dialyxir's changelog.

Unreleased changes post [1.4.8]

[1.4.8] - 2026-09-05

Added

  • Add support for the OTP 28 warnings :exact_compare, :opaque_compare, and :opaque_union.

Fixed

  • Handle line-and-column locations when matching line-specific warning ignores.

Changed

  • Update ExDoc to 0.40.3 to generate Markdown documentation and llms.txt.

Docs

  • Clarify the output and intended use of the ignore_file and ignore_file_strict formatters.
Commits
  • 13bcb7d Release 1.4.8
  • 4a2b6d7 Merge pull request #584 from lud-wj/fix/ignoring-by-line
  • a2a4361 Merge branch 'master' into fix/ignoring-by-line
  • 31a4cd8 Merge pull request #601 from BobbieBarker/docs/exdoc-0.40
  • 6ba7b38 Update ExDoc to 0.40.3
  • 3553678 Add OTP 28 warning support: exact_compare, opaque_compare, opaque_union (#591)
  • 19dd690 Merge pull request #597 from dl-alexandre/codex/clarify-ignore-file-format
  • f12db01 clarify ignore file formatter docs
  • cdcea96 fix: Fixed dialyzer ignore by line for warnings with line/col
  • 9fbbaf5 update changelog
  • See full diff in compare view

Updates ex_doc from 0.40.3 to 0.40.4

Changelog

Sourced from ex_doc's changelog.

v0.40.4 (2026-09-03)

  • Enhancements

    • Add :api_reference_noindex option to keep search engines from indexing api-reference.html
    • Generate reproducible HTML and EPUB output
    • Link HexDocs packages through their per-package subdomains

  • Bug fixes

    • Preserve in-page anchors during Swup navigation and fully reload navigation between ExDoc builds
    • Format Elixir specs consistently regardless of their source line numbers
    • Autolink the Erlang/OTP 29 built-in record/0 type
    • Fix focus outline positioning for top-content heading action icons
Commits
  • 80270f3 Release v0.40.4
  • 934cf54 Reference to missing section (#2264)
  • b5679af Add license information for remixicon font (#2263)
  • 850f709 Bump brace-expansion from 1.1.12 to 1.1.18 in /assets (#2261)
  • 873e03e Bump postcss from 8.5.15 to 8.5.26 in /assets (#2259)
  • 27660d3 Bump js-yaml from 4.2.0 to 4.3.1 in /assets (#2260)
  • ffec214 Bump postcss from 8.5.6 to 8.5.15 in /assets (#2241)
  • 23cbd23 epub: Honor SOURCE_DATE_EPOCH for dcterms:modified and dc:identifier (#2256)
  • a37128a Use a fixed makeup group_prefix for reproducible HTML output (#2255)
  • 01f4763 Update earmark_parser dependency version -> 1.4.46 (#2254)
  • Additional commits viewable in compare view

Updates igniter from 0.8.2 to 0.8.4

Release notes

Sourced from igniter's releases.

v0.8.4

Security

Bug Fixes:

  • strip terminal control sequences from hex install confirmation metadata (CVE-2026-82584)
  • restore application env exactly after evaluating project config (#400)
  • Control rerunning installers for existing packages (#399)
  • unbreak mix igniter.upgrade --git-ci, and positional args after flags (#397)
  • stop boolean flags consuming the following positional arg
  • don't require a package list for igniter.upgrade --git-ci

v0.8.3

Bug Fixes:

  • ensure verbose is passed all the way down by Zach Daniel

  • properly check igniter.rms in --check by Zach Daniel

  • resolve Elixir 1.20 type-check warnings (#387) by Gilbert

Improvements:

  • add Igniter.Libs.Phoenix.web_module_for_router/2 (#393) by James Harton

  • update to Elixir 1.20 (#391) by ESmithByui

  • direct users to format command for unless refactor by Zach Daniel

Changelog

Sourced from igniter's changelog.

v0.8.4 (2026-09-07)

Bug Fixes:

  • strip terminal control sequences from hex install confirmation metadata (CVE-2026-82584) by Zach Daniel

  • restore application env exactly after evaluating project config (#400) by neilberkman

  • Control rerunning installers for existing packages (#399) by mvanhorn

  • unbreak mix igniter.upgrade --git-ci, and positional args after flags (#397) by James Harton

  • stop boolean flags consuming the following positional arg by James Harton

  • don't require a package list for igniter.upgrade --git-ci by James Harton

v0.8.3 (2026-07-26)

Bug Fixes:

  • ensure verbose is passed all the way down by Zach Daniel

  • properly check igniter.rms in --check by Zach Daniel

  • resolve Elixir 1.20 type-check warnings (#387) by Gilbert

Improvements:

  • add Igniter.Libs.Phoenix.web_module_for_router/2 (#393) by James Harton

  • update to Elixir 1.20 (#391) by ESmithByui

  • direct users to format command for unless refactor by Zach Daniel

Commits
  • c6d2b7f chore: release version v0.8.4
  • d492b1a fix: strip terminal control sequences from hex install confirmation metadata
  • 1d9bb60 test: drop unfinished install-rerun tests that never compiled
  • b3fd506 fix: restore application env exactly after evaluating project config (#400)
  • c0379c4 fix: Control rerunning installers for existing packages (#399)
  • aa67bdd build(deps): bump the all-dependencies group with 3 updates (#398)
  • 26608c5 chore: use a single monthly dependabot group
  • 8b0f91c chore: fix tests
  • 31db3a5 fix: unbreak mix igniter.upgrade --git-ci, and positional args after flags ...
  • 64b02a4 build(deps): bump the production-dependencies group with 4 updates (#396)
  • Additional commits viewable in compare view

Updates mimic from 2.3.0 to 2.4.0

Release notes

Sourced from mimic's releases.

Mimic 2.4.0

What's Changed

Full Changelog: edgurgel/mimic@v2.3.1...v2.4.0

Mimic 2.3.1

What's Changed

New Contributors

Full Changelog: edgurgel/mimic@v2.3.0...v2.3.1

Changelog

Sourced from mimic's changelog.

2.4.0 (2026-08-22)

  • perf: shard Mimic.Server into one partition per scheduler (routed by owner pid) so concurrent async tests no longer serialize through a single process

2.3.1 (2026-08-07)

Commits

Updates quiver from 0.4.0 to 0.4.1

Release notes

Sourced from quiver's releases.

v0.4.1

0.4.1 (2026-08-04)

Bug Fixes

  • deps: Updated dependencies and elixir to 1.20 (4cffa94)
Changelog

Sourced from quiver's changelog.

0.4.1 (2026-08-04)

Bug Fixes

  • deps: Updated dependencies and elixir to 1.20 (4cffa94)
Commits

Updates sycophant from 0.5.0 to 0.5.1

Release notes

Sourced from sycophant's releases.

sycophant: v0.5.1

0.5.1 (2026-08-04)

Bug Fixes

  • llmdb: Fixed upstream llmdb broken contract (18bd856)
Changelog

Sourced from sycophant's changelog.

0.5.1 (2026-08-04)

Bug Fixes

  • llmdb: Fixed upstream llmdb broken contract (18bd856)
Commits

Updates tidewave from 0.8.0 to 0.9.0

Changelog

Sourced from tidewave's changelog.

v0.9.0 (2026-08-18)

  • Add create_design_canvas tool
  • Allow requests to tidewave.ai in CSP if toolbar is enabled
  • Remove get_*_schema tools

v0.8.4 (2026-08-14)

  • Fix crash in diagnostic log handler

v0.8.3 (2026-08-13)

  • Support LiveView patching diagnostics

v0.8.2 (2026-08-05)

  • Use action_inputs for browser_eval

v0.8.1 (2026-07-29)

  • Add Tidewave Connect support
Commits

Updates usage_rules from 1.2.6 to 1.2.8

Release notes

Sourced from usage_rules's releases.

v1.2.8

Security

  • Fixes a terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata indexed by search.hexdocs.pm (CVE-2026-82710, GHSA-j59f-776f-23hp).

Bug Fixes:

  • strip terminal control sequences from hex docs search results (CVE-2026-82710)

What's Changed

Full Changelog: ash-project/usage_rules@v1.2.7...v1.2.8

v1.2.7

What's Changed

New Contributors

Full Changelog: ash-project/usage_rules@v1.2.6...v1.2.7

Changelog

Sourced from usage_rules's changelog.

v1.2.8 (2026-09-07)

Bug Fixes:

  • strip terminal control sequences from hex docs search results (CVE-2026-82710) by Zach Daniel

v1.2.7 (2026-07-26)

Bug Fixes:

  • handle package sub-rule conflicts in skill generation by Zach Daniel

  • Add CHANGELOG link from docs (#73) by Philip Munksgaard

  • disambiguate references in built skills (#71) by Philip Munksgaard

Improvements:

  • Special case docs search for private packages (#80) by Parker Selbert

  • adding except option and list option (#77) by ESmithByui

Commits
  • 8ffebf9 chore: release version v1.2.8
  • 3b8ebb4 fix: strip terminal control sequences from hex docs search results
  • f1c8296 chore: use a single monthly dependabot group
  • 3705110 chore(deps-dev): bump the dev-dependencies group with 2 updates (#86)
  • 65ab8ab Merge pull request #85 from ash-project/dependabot/hex/production-dependencie...
  • ffbd947 chore(deps): bump the production-dependencies group with 2 updates
  • 49d40d1 chore: release version v1.2.7
  • 0fc2e74 fix: handle package sub-rule conflicts in skill generation
  • 343335f Remove Logger requirement from usage_rules task (#84)
  • 4e75c84 chore(deps): bump the production-dependencies group across 1 directory with 2...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the all-dependencies group with 9 updates
59109b6 
Bumps the all-dependencies group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [bandit](https://github.com/mtrudel/bandit) | `1.12.0` | `1.12.5` |
| [dialyxir](https://github.com/jeremyjh/dialyxir) | `1.4.7` | `1.4.8` |
| [ex_doc](https://github.com/elixir-lang/ex_doc) | `0.40.3` | `0.40.4` |
| [igniter](https://github.com/ash-project/igniter) | `0.8.2` | `0.8.4` |
| [mimic](https://github.com/edgurgel/mimic) | `2.3.0` | `2.4.0` |
| [quiver](https://github.com/edlontech/quiver) | `0.4.0` | `0.4.1` |
| [sycophant](https://github.com/edlontech/sycophant) | `0.5.0` | `0.5.1` |
| [tidewave](https://github.com/tidewave-ai/tidewave_phoenix) | `0.8.0` | `0.9.0` |
| [usage_rules](https://github.com/ash-project/usage_rules) | `1.2.6` | `1.2.8` |


Updates `bandit` from 1.12.0 to 1.12.5
- [Changelog](https://github.com/mtrudel/bandit/blob/main/CHANGELOG.md)
- [Commits](mtrudel/bandit@1.12.0...1.12.5)

Updates `dialyxir` from 1.4.7 to 1.4.8
- [Release notes](https://github.com/jeremyjh/dialyxir/releases)
- [Changelog](https://github.com/jeremyjh/dialyxir/blob/1.4.8/CHANGELOG.md)
- [Commits](jeremyjh/dialyxir@1.4.7...1.4.8)

Updates `ex_doc` from 0.40.3 to 0.40.4
- [Release notes](https://github.com/elixir-lang/ex_doc/releases)
- [Changelog](https://github.com/elixir-lang/ex_doc/blob/main/CHANGELOG.md)
- [Commits](elixir-lang/ex_doc@v0.40.3...v0.40.4)

Updates `igniter` from 0.8.2 to 0.8.4
- [Release notes](https://github.com/ash-project/igniter/releases)
- [Changelog](https://github.com/ash-project/igniter/blob/main/CHANGELOG.md)
- [Commits](ash-project/igniter@v0.8.2...v0.8.4)

Updates `mimic` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/edgurgel/mimic/releases)
- [Changelog](https://github.com/edgurgel/mimic/blob/main/CHANGELOG.md)
- [Commits](edgurgel/mimic@v2.3.0...v2.4.0)

Updates `quiver` from 0.4.0 to 0.4.1
- [Release notes](https://github.com/edlontech/quiver/releases)
- [Changelog](https://github.com/edlontech/quiver/blob/main/CHANGELOG.md)
- [Commits](edlontech/quiver@v0.4.0...v0.4.1)

Updates `sycophant` from 0.5.0 to 0.5.1
- [Release notes](https://github.com/edlontech/sycophant/releases)
- [Changelog](https://github.com/edlontech/sycophant/blob/main/CHANGELOG.md)
- [Commits](edlontech/sycophant@sycophant-v0.5.0...sycophant-v0.5.1)

Updates `tidewave` from 0.8.0 to 0.9.0
- [Changelog](https://github.com/tidewave-ai/tidewave_phoenix/blob/main/CHANGELOG.md)
- [Commits](tidewave-ai/tidewave_phoenix@v0.8.0...v0.9.0)

Updates `usage_rules` from 1.2.6 to 1.2.8
- [Release notes](https://github.com/ash-project/usage_rules/releases)
- [Changelog](https://github.com/ash-project/usage_rules/blob/main/CHANGELOG.md)
- [Commits](ash-project/usage_rules@v1.2.6...v1.2.8)

---
updated-dependencies:
- dependency-name: bandit
  dependency-version: 1.12.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: dialyxir
  dependency-version: 1.4.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: ex_doc
  dependency-version: 0.40.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: igniter
  dependency-version: 0.8.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: mimic
  dependency-version: 2.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: quiver
  dependency-version: 0.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: sycophant
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: tidewave
  dependency-version: 0.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: usage_rules
  dependency-version: 1.2.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code labels Sep 11, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 15, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 15, 2026
@dependabot
dependabot Bot deleted the dependabot/hex/all-dependencies-361dc3f8a0 branch September 15, 2026 12:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants