chore(deps): bump the prod group across 1 directory with 2 updates

[dependabot]

Bumps the prod group with 2 updates in the / directory: plug and redix.

Updates plug from 1.19.1 to 1.20.3

Changelog

Sourced from plug's changelog.

v1.20.3 (2026-07-09)

Security

• [Plug.Parsers.MULTIPART] Count files and skipped multipart parts towards the length limit (CVE-2026-56814)
• [Plug.Conn.Cookies] Raise if ; is present in cookie attributes (CVE-2026-56813)

v1.20.2 (2026-06-30)

Bug fixes

• [Plug.Conn] Set state to :set_upgrade and status to 101 when running before_send callbacks for upgrades

v1.20.1 (2026-06-23)

Bug fixes

• [Plug.Conn] Fix inform/inform! when atoms are given as header keys

v1.20.0 (2026-06-23)

This release requires Elixir v1.15+.

Enhancements

• [Plug.RequestId] Make request ID generation configurable
• [Plug.Test] Support :sign and :encrypt options in put_req_cookie/4

Bug fixes

• [Plug.Conn] Run before_send callbacks before upgrade_adapter/3
• [Plug.Debugger] Raise if Elixir is compiled without source information
• [Plug.RewriteOn] Rewrite the protocol to HTTPS when x-forwarded-proto is wss
• [Plug.Static] Return 416 for invalid range requests
• [Plug.Static] Fix :raise_on_missing_only raising on non-matching paths with colons

Optimizations

• [Plug.Conn.Cookies] Optimize cookie parsing
• [Plug.Conn.Cookies] Optimize cookie encoding
• [Plug.Conn.Utils] Optimize validate_utf8!/3
• [Plug.Conn.Utils] Optimize splitting by semicolons
• [Plug.Router] Optimize host matching

v1.19.5 (2026-07-09)

Security

• [Plug.Parsers.MULTIPART] Count files and skipped multipart parts towards the length limit (CVE-2026-56814)
• [Plug.Conn.Cookies] Raise if ; is present in cookie attributes (CVE-2026-56813)

... (truncated)

Commits

• 9fa11c8 Release v1.20.3
• eceb831 Raise if ; is present in cookie attributes
• 56edca2 Count files and skipped multiparts towards length
• cf15f0a Release v1.20.2
• 5d0fe88 Fix register_before_send with upgrade_adapter (#1320)
• 1fea083 Release v1.20.1
• 9df2c0a Allow atom header keys in inform/3 (#1318)
• d8d733b Release v1.20.0
• b4aa8a0 Merge commit from fork
• ac94702 Validate headers in inform
• Additional commits viewable in compare view

Updates redix from 1.5.3 to 1.6.0

Changelog

Sourced from redix's changelog.

v1.6.0

• Add support for Redis Cluster. This is a major feature and this its first release, so use with care—I only tested it (extensively) in non-production-grade scenarios; it was tested on various synthetic environments (like with AWS ElastiCache and locally via Docker) but it has not seen the horrors of production traffic. See the Redix.Cluster documentation to get started.
• Add Redix.PubSub.ping/2.
• Fix Elixir 1.19/1.20 warnings.

Unreleased

New features

• Add support for reading from replicas in Redix.Cluster. Start the cluster with read_from_replicas: true to open and supervise a connection to every replica (each one gets a READONLY after connecting), then pass route: :replica or route: :prefer_replica to Redix.Cluster.command/3 and Redix.Cluster.pipeline/3 to send reads to replicas. The default routing stays :primary, so existing behavior is unchanged.
• Route commands outside Redix.Cluster's built-in command table to the correct node. Previously commands the driver didn't recognize were treated as keyless and sent to a random node; now their keys are resolved against the server (via COMMAND INFO, with a COMMAND GETKEYS fallback for commands with movable keys) and the result is cached per command name, so repeated calls add no extra round-trips. The built-in table also grew to cover more commands directly (bit commands, the blocking B* list/sorted-set pops, hash-field expiration commands, XSETID, and BITOP).
• Add a :readonly option to Redix.start_link/1 that issues READONLY after every (re)connection.
• Add a :health_check_interval option to Redix.start_link/1 that detects half-open connections (the socket is open but the server stopped replying) and reconnects. This fixes slow recovery after a Sentinel failover where the old primary is paused (for example via CLIENT PAUSE): the reconnection re-queries the sentinels and lands on the new primary instead of staying wedged. Defaults to :infinity (disabled).

Changes

• Verify SSL server hostnames the way browsers do (RFC 6125) by default, which accepts the wildcard certificates used by servers such as Amazon ElastiCache. This sets customize_hostname_check automatically; you can still override it (or any other default SSL option) through :socket_opts.

Bug fixes

• Bound the total wall-clock of a steady-state Redix.Cluster topology refresh. The refresh runs on the cluster manager's process and probes seed/known nodes serially, so a few black-holed nodes (which accept the connection but never reply) used to block the manager—and every connection restart or MOVED/ASK redirect that needs it—for up to one connection :timeout per node, i.e. tens of seconds. A refresh now stops probing once it exhausts a single :timeout budget, relying on the next refresh for any skipped nodes. The initial topology discovery stays unbounded so startup reliably reaches a reachable seed.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions