Skip to content

Bump the mix group across 1 directory with 4 updates - #13

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/mix-1c26c370d1
Closed

Bump the mix group across 1 directory with 4 updates#13
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/mix-1c26c370d1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the mix group with 4 updates in the / directory: public_sufx, quokka, req and tesla.

Updates public_sufx from 0.7.20260507 to 0.7.20260528

Changelog

Sourced from public_sufx's changelog.

Changelog

All notable changes to this project will be documented in this file.

Releases that update only the public suffix list won't be listed in the changelog.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Commits
  • 3b5a379 Update public suffix list, make minor improvements
  • 7013486 Harden GH actions security
  • 3ff3fd7 Improve shell scripts
  • 0c6fbc0 Update elixir/OTP
  • 313a72a Set up ex_slop
  • 321c0ed Update deps
  • 5f6cd20 Merge remote-tracking branch 'origin/dependabot/github_actions/actions-6a98ab...
  • 957a2b7 Update public suffix list
  • e726f72 Bump actions/checkout from 6.0.2 to 6.0.3 in the actions group
  • 8f799cc [skip publish] Bump actions/cache from 3.5.0 to 5.0.5
  • Additional commits viewable in compare view

Updates quokka from 2.12.1 to 2.13.1

Release notes

Sourced from quokka's releases.

v2.13.1

Fixes

  • Fix Enum.reduce/3 in a pipe being incorrectly rewritten to a nonexistent two-argument Enum.sum call. Piped lhs |> Enum.reduce(acc, reducer) was styled as Enum.reduce/2 and could emit invalid Enum.sum(acc) when the reducer was a simple sum. Fixes #160.
  • Fix autosort stealing comments from earlier in the module when sorting multi-line maps. Comments such as # credo:disable-for-next-line in unrelated code could be detached from the lines they suppress. Fixes #161.

v2.13.0

Breaking Changes

  • Sorting is now split into two independent mechanisms. See Autosort for the full comparison.
    • Config autosort (maps, defstructs, schemas): controlled by autosort: [...] and the :autosort style in :only or :exclude.
    • # quokka:sort (per-value, opt-in): always runs; not affected by :only, :exclude, or exclude: [:autosort].
  • If you use :only or :exclude to limit which styles run, replace :comment_directives with :autosort to control config-driven sorting. The autosort: [...] option is unchanged.

Improvements

  • Added support for plugins; see Quokka.Plugin docs for details on creating your own formatting rules.
  • Overhaul config-driven autosort: extracted into a dedicated style with its own docs. Maps with comments are now autosorted (comments stay with their keys). Use # quokka:skip-sort on the line above a value to opt out.
  • Support # quokka:sort for struct field keys in @type definitions (e.g. @type t :: %__MODULE__{...}).
  • Respect Credo's Credo.Check.Readability.OnePipePerLine — breaks pipe chains so each |> is on its own line when the check is enabled.
  • Respect Credo's Credo.Check.Refactor.CondStatements configuration. Set the check to false to disable cond simplification.
  • Module directive skip comments (# quokka:skip-module-directives, # quokka:skip-module-directive-reordering, etc.) now work inside defimpl blocks. Module directives in defimpl and defprotocol are reordered when no skip comment is present.
  • Respect Credo's Credo.Check.Readability.StrictModuleLayout ignore_module_attributes and ignore: [:module_attribute] options. When a module contains an ignored module attribute, Quokka preserves the original directive order for that module rather than hoisting directives above the attribute (which could be referenced by an earlier-ordered directive such as @moduledoc). Fixes #137.
  • Rewrite Enum.reduce/2,3 calls that simply sum their two arguments to Enum.sum/1 (part of inefficient function rewrites).
  • Rewrite Enum.drop/2 + Enum.take/2 to Enum.slice/3 when both arguments are non-negative integer literals (part of inefficient function rewrites).

Fixes

  • Fix alias duplication in # quokka:skip-module-directive-reordering mode when an existing alias was also referenced from non-alias content.
  • Fix crash when formatting empty modules (e.g. a defmodule with no body inside a quote block).
  • Fix autosort so comments above map keys are preserved correctly after sorting.

Deprecations

  • :comment_directives is no longer a valid :only or :exclude style. Use :autosort to control config-driven sorting instead. # quokka:sort always runs and cannot be disabled. exclude: [:comment_directives] has no effect and logs a warning; only: [:comment_directives] no longer enables config autosort — add :autosort if you need it.
Changelog

Sourced from quokka's changelog.

[2.13.1] - 2026-05-19

Fixes

  • Fix Enum.reduce/3 in a pipe being incorrectly rewritten to a nonexistent two-argument Enum.sum call. Piped lhs |> Enum.reduce(acc, reducer) was styled as Enum.reduce/2 and could emit invalid Enum.sum(acc) when the reducer was a simple sum. Fixes #160.
  • Fix autosort stealing comments from earlier in the module when sorting multi-line maps. Comments such as # credo:disable-for-next-line in unrelated code could be detached from the lines they suppress. Fixes #161.

[2.13.0] - 2026-05-18

Breaking Changes

  • Sorting is now split into two independent mechanisms. See Autosort for the full comparison.
    • Config autosort (maps, defstructs, schemas): controlled by autosort: [...] and the :autosort style in :only or :exclude.
    • # quokka:sort (per-value, opt-in): always runs; not affected by :only, :exclude, or exclude: [:autosort].
  • If you use :only or :exclude to limit which styles run, replace :comment_directives with :autosort to control config-driven sorting. The autosort: [...] option is unchanged.

Improvements

  • Added support for plugins; see Quokka.Plugin docs for details on creating your own formatting rules.
  • Overhaul config-driven autosort: extracted into a dedicated style with its own docs. Maps with comments are now autosorted (comments stay with their keys). Use # quokka:skip-sort on the line above a value to opt out.
  • Support # quokka:sort for struct field keys in @type definitions (e.g. @type t :: %__MODULE__{...}).
  • Respect Credo's Credo.Check.Readability.OnePipePerLine — breaks pipe chains so each |> is on its own line when the check is enabled.
  • Respect Credo's Credo.Check.Refactor.CondStatements configuration. Set the check to false to disable cond simplification.
  • Module directive skip comments (# quokka:skip-module-directives, # quokka:skip-module-directive-reordering, etc.) now work inside defimpl blocks. Module directives in defimpl and defprotocol are reordered when no skip comment is present.
  • Respect Credo's Credo.Check.Readability.StrictModuleLayout ignore_module_attributes and ignore: [:module_attribute] options. When a module contains an ignored module attribute, Quokka preserves the original directive order for that module rather than hoisting directives above the attribute (which could be referenced by an earlier-ordered directive such as @moduledoc). Fixes #137.
  • Rewrite Enum.reduce/2,3 calls that simply sum their two arguments to Enum.sum/1 (part of inefficient function rewrites).
  • Rewrite Enum.drop/2 + Enum.take/2 to Enum.slice/3 when both arguments are non-negative integer literals (part of inefficient function rewrites).

Fixes

  • Fix alias duplication in # quokka:skip-module-directive-reordering mode when an existing alias was also referenced from non-alias content.
  • Fix crash when formatting empty modules (e.g. a defmodule with no body inside a quote block).
  • Fix autosort so comments above map keys are preserved correctly after sorting.

Deprecations

  • :comment_directives is no longer a valid :only or :exclude style. Use :autosort to control config-driven sorting instead. # quokka:sort always runs and cannot be disabled. exclude: [:comment_directives] has no effect and logs a warning; only: [:comment_directives] no longer enables config autosort — add :autosort if you need it.
Commits

Updates req from 0.5.17 to 0.6.1

Release notes

Sourced from req's releases.

v0.6.1

v0.6.0

  • encode_body: Security fix for :form_multipart header injection (GHSA-px9f-whj3-246m).

    The multipart encoder interpolated the per-part name, filename, and content_type into the part headers without escaping, so an attacker-controlled value could inject extra headers or smuggle additional parts into the request. These values are now escaped per RFC 7578 / WHATWG form-data (", CR, and LF are percent-encoded).

    Thanks to @​PJUllrich for reporting it.

  • decode_body: Drop automatic zip/tar/tgz/gz/zst/csv decoding, (GHSA-655f-mp8p-96gv).

    Req previously auto-decoded archive and compressed response bodies (zip, tar, tgz, gz, zst, and csv) based on the server-supplied content-type, materialising the full decompressed contents in memory with no size cap. An attacker-controlled (or redirect-reachable) endpoint could return a tiny "decompression bomb" that expanded to gigabytes and exhausted the node's memory.

    Now only JSON is decoded by default. Other formats are opt-in via the new :decoders option, which defaults to [:json, :json_api]. Setting it replaces the default (include :json to keep JSON decoding), and false disables all decoding:

    # opt into archives (only for endpoints you trust):
Req.get!(url, decoders: [:json, :zip])

    Note: The decoded zip/tar is still list of {filename :: charlist(), contents :: binary} tuples. In the future release, this will be list of {filename :: binary(), contents :: binary()} tuples.

    While automatic CSV decoding wasn't a security issue, the behaviour based on presence/absence of nimble_csv dependency was suprising. CSV support is still built-in but need to be enabled with decoders: [:csv].

... (truncated)

Changelog

Sourced from req's changelog.

v0.6.1 (2026-06-08)

  • [compressed], [decompress_body]: Disable automatic decompression

    Decompression is now opt-in by setting compressed: true.

v0.6.0 (2026-06-08)

  • [encode_body]: Security fix for :form_multipart header injection (GHSA-px9f-whj3-246m).

    The multipart encoder interpolated the per-part name, filename, and content_type into the part headers without escaping, so an attacker-controlled value could inject extra headers or smuggle additional parts into the request. These values are now escaped per RFC 7578 / WHATWG form-data (", CR, and LF are percent-encoded).

    Thanks to @​PJUllrich for reporting it.

  • [decode_body]: Drop automatic zip/tar/tgz/gz/zst/csv decoding, (GHSA-655f-mp8p-96gv).

    Req previously auto-decoded archive and compressed response bodies (zip, tar, tgz, gz, zst, and csv) based on the server-supplied content-type, materialising the full decompressed contents in memory with no size cap. An attacker-controlled (or redirect-reachable) endpoint could return a tiny "decompression bomb" that expanded to gigabytes and exhausted the node's memory.

    Now only JSON is decoded by default. Other formats are opt-in via the new :decoders option, which defaults to [:json, :json_api]. Setting it replaces the default (include :json to keep JSON decoding), and false disables all decoding:

    # opt into archives (only for endpoints you trust):
Req.get!(url, decoders: [:json, :zip])

    Note: The decoded zip/tar is still list of {filename :: charlist(), contents :: binary} tuples. In the future release, this will be list of {filename :: binary(), contents :: binary()} tuples.

    While automatic CSV decoding wasn't a security issue, the behaviour based on presence/absence of nimble_csv dependency was suprising. CSV support is still built-in but need to be enabled with decoders: [:csv].

    Custom decoders are supported via {format, codec} tuples, where codec is a module exporting decode/1 or a 1-arity function returning an :ok/:error tuple, for example:

... (truncated)

Commits
  • 36a8252 Release v0.6.1
  • ea5506f compressed, decompress_body: Disable automatic decompression
  • 8e7425f Release v0.6.0
  • 584a490 decode_body: Drop automatic zip/tar/tgz/gz/zst/csv decoding
  • 2d77dbe encode_body: Security fix for :form_multipart header injection
  • 53c3b99 Release v0.5.18
  • dc1f3be Update ex_doc
  • dbd145c Update CHANGELOG.md
  • 75f077e retry: Automatically retry on :pool_not_available
  • 4cfbf54 run_finch: Normalize Finch.TransportError,HTTPError (Finch 0.22+) (#544)
  • Additional commits viewable in compare view

Updates tesla from 1.17.0 to 1.20.0

Release notes

Sourced from tesla's releases.

v1.20.0

1.20.0 (2026-06-05)

Features

  • support {:form,data} tagged body tuples (#886) (b1b3b80)

v1.19.0

1.19.0 (2026-06-04)

Features

  • finch-adapter: Finch adapter will pass through all supported options (#879) (7609328)
  • form-urlencoded: support nested bodies via :brackets option (#878) (f7142e8)

v1.18.3

1.18.3 (2026-06-02)

Important {: .error}

Please be careful using :hackney it is recommended to actually test the application before assuming we did not introduce any breaking changes. Also, be aware of the security vulnerabilities we have fixed in this release. Some of them may cause some unexpected behavior from the middleware depending on the assumptions made by the caller.

Features

Security CVE

  • CVE-2026-48598 - Multipart part smuggling via unescaped content-disposition values
  • CVE-2026-48597 - Atom exhaustion via untrusted URL scheme
  • CVE-2026-48596 - CRLF injection in request Content-Type header via add_content_type_param
  • CVE-2026-48595 - Authorization header leaks on cross-origin redirect via case-sensitive filtering
  • CVE-2026-48594 - Decompression bomb on response body

v1.18.2

1.18.2 (2026-05-15)

Bug Fixes

  • builder: include :assigns and :private in request option type (#876) (f5834c1)

v1.18.1

1.18.1 (2026-05-14)

... (truncated)

Changelog

Sourced from tesla's changelog.

1.20.0 (2026-06-05)

Features

  • support {:form,data} tagged body tuples (#886) (b1b3b80)

1.19.0 (2026-06-04)

Features

  • finch-adapter: Finch adapter will pass through all supported options (#879) (7609328)
  • form-urlencoded: support nested bodies via :brackets option (#878) (f7142e8)

1.18.3 (2026-06-02)

Important {: .error}

Please be careful using :hackney it is recommended to actually test the application before assuming we did not introduce any breaking changes. Also, be aware of the security vulnerabilities we have fixed in this release. Some of them may cause some unexpected behavior from the middleware depending on the assumptions made by the caller.

Features

Security CVE

  • CVE-2026-48598 - Multipart part smuggling via unescaped content-disposition values
  • CVE-2026-48597 - Atom exhaustion via untrusted URL scheme
  • CVE-2026-48596 - CRLF injection in request Content-Type header via add_content_type_param
  • CVE-2026-48595 - Authorization header leaks on cross-origin redirect via case-sensitive filtering
  • CVE-2026-48594 - Decompression bomb on response body

1.18.2 (2026-05-15)

Bug Fixes

  • builder: include :assigns and :private in request option type (#876) (f5834c1)

1.18.1 (2026-05-14)

Bug Fixes

  • path-params: raise on missing required path parameter values (#874) (a1dd44b)

... (truncated)

Commits
  • 901ce60 chore(master): release 1.20.0 (#887)
  • b1b3b80 feat: support {:form,data} tagged body tuples (#886)
  • 603ea34 chore(master): release 1.19.0 (#885)
  • 7609328 feat(finch-adapter): Finch adapter will pass through all supported options (#...
  • f7142e8 feat(form-urlencoded): support nested bodies via :brackets option (#878)
  • 2d3c800 chore(ci): bump release workflow to Elixir 1.19 / OTP 28 (#884)
  • 2eb7a78 chore(master): release 1.18.3 (#883)
  • 3a369b8 chore: release 1.18.3
  • 340f75b Merge commit from fork
  • db963db Merge commit from fork
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the mix group across 1 directory with 4 updates
7d2e699 
Bumps the mix group with 4 updates in the / directory: [public_sufx](https://github.com/reisub/public_sufx), [quokka](https://github.com/smartrent/quokka), [req](https://github.com/wojtekmach/req) and [tesla](https://github.com/elixir-tesla/tesla).


Updates `public_sufx` from 0.7.20260507 to 0.7.20260528
- [Changelog](https://github.com/reisub/public_sufx/blob/main/CHANGELOG.md)
- [Commits](reisub/public_sufx@v0.7.20260507...v0.7.20260528)

Updates `quokka` from 2.12.1 to 2.13.1
- [Release notes](https://github.com/smartrent/quokka/releases)
- [Changelog](https://github.com/emkguts/quokka/blob/main/CHANGELOG.md)
- [Commits](emkguts/quokka@v2.12.1...v2.13.1)

Updates `req` from 0.5.17 to 0.6.1
- [Release notes](https://github.com/wojtekmach/req/releases)
- [Changelog](https://github.com/wojtekmach/req/blob/main/CHANGELOG.md)
- [Commits](wojtekmach/req@v0.5.17...v0.6.1)

Updates `tesla` from 1.17.0 to 1.20.0
- [Release notes](https://github.com/elixir-tesla/tesla/releases)
- [Changelog](https://github.com/elixir-tesla/tesla/blob/master/CHANGELOG.md)
- [Commits](elixir-tesla/tesla@v1.17.0...v1.20.0)

---
updated-dependencies:
- dependency-name: public_sufx
  dependency-version: 0.7.20260528
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix
- dependency-name: quokka
  dependency-version: 2.13.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: mix
- dependency-name: req
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix
- dependency-name: tesla
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code labels Jun 10, 2026
@reisub reisub closed this Jun 10, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 10, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/hex/mix-1c26c370d1 branch June 10, 2026 21:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@reisub reisub

Labels

dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@reisub