chore(deps): bump mint from 1.9.0 to 1.9.3

[dependabot]

Bumps mint from 1.9.0 to 1.9.3.

Changelog

Sourced from mint's changelog.

v1.9.3

• Prevent signed integers when parsing HTTP/1 chunk sizes. This is a fix for CVE-2026-59249 (GitHub advisory).

v1.9.2

• Cap HTTP/1 total header size for responses. This is a fix for CVE-2026-58229 (GitHub advisory GHSA-qrfr-wh4c-3qhw).
• Do not store empty CONTINUATION (HTTP/2) frames. This is a fix for CVE-2026-59246 (GitHub advisory GHSA-8pf6-g464-h6h9).

v1.9.1

Security

• HTTP/1.1 chunked response bodies are now emitted as {:data, ref, data} tuples as soon as data from the chunked body is received. This prevents CVE-2026-56810: the previous behavior was to buffer body chunks according to their advertised length. An attacker could craft a chunked response with a very large chunk length, and Mint would keep accumulating incoming chunked bytes in memory until reaching that length—allowing the attacker to OOM the application using Mint. See also the GHSA-c59h-fq4p-r36r GitHub advisory.

Commits

• f0b72c0 Release v1.9.3
• fc7d165 Merge commit from fork
• 5cbf7a3 Merge commit from fork
• d066c66 Fix Dialyzer
• 0622056 Release v1.9.2
• 566d702 Merge commit from fork
• 5779de1 Merge commit from fork
• bc63e9b Bump Elixir/Erlang versions in CI (#490)
• bc92a3a Fix Dialyzer
• f9a56d9 Release v1.9.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)