chore(deps): bump the elixir-dependencies group with 7 updates by dependabot[bot] · Pull Request #183 · zorn/flick

dependabot · 2026-08-01T21:48:03Z

Bumps the elixir-dependencies group with 7 updates:

Package	From	To
bandit	`1.12.0`	`1.12.4`
lazy_html	`0.1.11`	`0.1.12`
mdex	`0.13.3`	`0.13.5`
phoenix_live_reload	`1.6.2`	`1.7.0`
phoenix_live_view	`1.2.7`	`1.2.8`
req	`0.6.2`	`0.7.1`
swoosh	`1.26.3`	`1.27.0`

Updates bandit from 1.12.0 to 1.12.4

Changelog

Sourced from bandit's changelog.

1.12.4 (27 July 2026)

Fixes

Properly send Connection: close header when client requests closure (#617)

Disallow transfer-encoding on HTTP/1.0 connections (#618)

Reject requests with multiple Host headers (#619)

Reject malformed header lines (#620)

Fix handling of chunk extensions (#621)

Enhancements

Tighten up CI against supply chain attacks (#623, thanks @Totara-thib!)

Reorganize and increase coverage of HTTP/1 tests to better match RFC structure (#616)

Tolerate a leading newline on HTTP/1 requests (#622)

Send "100 Continue" interim response before reading body if client requests it (#624)

1.12.3 (25 July 2026)

Enhancements

Cache connection-level data between HTTP/1 keepalives (#603, thanks @preciz!)

1.12.2 (25 July 2026)

Enhancements

Improve internal HTTP/2 error handling to be better about closing stream/connection

Coalesce header and body in to single transport send (#606, thanks @NelsonVides!)

Improve compression behaviour when streaming an explicitly length delimited body (#605, thanks @elibosley!)

Quiet WebSocket deserialization errors, add verbosity config lever (#610, thanks @ericmj!)

Send connection: close when we're at max_requests (#613, thanks @joshdchang!)

Fixes

Fix bogus check for unmasked WebSocket frames (GHSA-rhh8-5xw9-c3gm, thanks @lukaszsamson!)

Enforce max_header_list_size if overridden (GHSA-9q5m-g6v3-6772, thanks @lukaszsamson!)

1.12.1 (24 July 2026)

Fixes

Fix DoS issue with fragmented WebSocket frames (CVE-2026-65623, thanks @PJUllrich!)

Commits

00d532f Version bump to 1.12.4
1663203 Handle clients sending an Expect: 100-continue header before sending a body...
e3c6595 Fixup linting error
c430bf5 Reapply "Pin GitHub Actions to commit SHAs (#623)"
a6fabe8 Revert "Pin GitHub Actions to commit SHAs (#623)"
e479c3b Pin GitHub Actions to commit SHAs (#623)
eba04e4 Tolerate a leading empty line before the request line (RFC9112§2.2) (#622)
c31e9e3 Fix crash on unrecognized chunk extensions (#621)
c24bc00 Reject header values containing CR, LF, or NUL (#620)
a518b29 Reject requests with multiple Host headers (#619)
Additional commits viewable in compare view

Updates lazy_html from 0.1.11 to 0.1.12

Release notes

Sourced from lazy_html's releases.

v0.1.12

Changed

Relaxed elixir_make requirement (#35)

Changelog

Sourced from lazy_html's changelog.

Commits

f30bc5e Release v0.1.12
5e9e3ee Bump otp on ci (#39)
fd02a1d Do not start elixir_make and fine at runtime (#36)
bb64356 Relax elixir_make requirement to allow 0.10.0 (#35)
e65f0cd Update version
See full diff in compare view

Updates mdex from 0.13.3 to 0.13.5

Release notes

Sourced from mdex's releases.

v0.13.5

0.13.5 (2026-07-29)

Bug Fixes

LiveView 1.2 deprecation warnings( EEx.compile ) (#380) (b4c8247)

relax phoenix_live_view version (572d30d)

v0.13.4

0.13.4 (2026-07-17)

Changes

require mdex_native >= 0.2.6

Features

update mdex_native and comrak (#377) (7739bf5) and (#382) (f782966)

Add LaTeX-style math delimiters with extension: [math_latex: true].

Add attribute parsing for headings, fenced code blocks, inline code, links, and images. Enable it with the :header_attributes, :fenced_code_attributes, :inline_code_attributes, and :link_attributes extension options. Parsed attributes are available in the document AST as %MDEx.Attributes{}.

Add semantic HTML for alerts with render: [alert_style: :semantic].

Heading anchors generated by :header_id_prefix now appear after the heading content, include an accessible aria-label, and are no longer hidden from assistive technology.

update lumis (#377) (7739bf5)

Changelog

Sourced from mdex's changelog.

0.13.5 (2026-07-29)

Bug Fixes

LiveView 1.2 deprecation warnings( EEx.compile ) (#380) (b4c8247)

relax phoenix_live_view version (572d30d)

0.13.4 (2026-07-17)

Changes

require mdex_native >= 0.2.6

Features

update mdex_native and comrak (#377) (7739bf5) and (#382) (f782966)

Add LaTeX-style math delimiters with extension: [math_latex: true].

Add attribute parsing for headings, fenced code blocks, inline code, links, and images. Enable it with the :header_attributes, :fenced_code_attributes, :inline_code_attributes, and :link_attributes extension options. Parsed attributes are available in the document AST as %MDEx.Attributes{}.

Add semantic HTML for alerts with render: [alert_style: :semantic].

Heading anchors generated by :header_id_prefix now appear after the heading content, include an accessible aria-label, and are no longer hidden from assistive technology.

update lumis (#377) (7739bf5)

Commits

a6099c4 chore(main): release 0.13.5 (#383)
c0e9523 chore(deps): bump lumis from 0.6.2 to 0.6.3 (#385)
08239b0 chore(deps): bump phoenix_live_view from 1.2.7 to 1.2.8 (#384)
572d30d fix: relax phoenix_live_view version
b4c8247 fix: LiveView 1.2 deprecation warnings( EEx.compile ) (#380)
af2bc86 chore(main): release 0.13.4 (#378)
f782966 feat: update mdex_native (#382)
8897bdf chore(deps): bump phoenix_live_view from 1.2.6 to 1.2.7 (#381)
7739bf5 deps: update mdex_native and lumis (#377)
afd066e chore(deps): bump phoenix_live_view from 1.2.5 to 1.2.6 (#376)
Additional commits viewable in compare view

Updates phoenix_live_reload from 1.6.2 to 1.7.0

Changelog

Sourced from phoenix_live_reload's changelog.

1.7.0 (2026-07-29)

Enhancements

Add JavaScript helper function to capture keyboard shortcuts to open HEEx components

Forward log events to window for custom behaviour

Commits

923bc44 Release v1.7.0
93cb716 Merge pull request #175 from phoenixframework/sd-log-simplify-shortcut
0a818d6 fix
c53da4a docs
d323ac7 allow configuring extra keys
d7b2562 require both keys
f332dec Emit log event and simplify editor shortcut configuration
d76ba2c Merge pull request #176 from phoenixframework/sd-bump-elixir-ci
f47fadd bump CI images
11405a8 Merge pull request #154 from joshamb/main
See full diff in compare view

Updates phoenix_live_view from 1.2.7 to 1.2.8

Release notes

Sourced from phoenix_live_view's releases.

v1.2.8

Enhancements

Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.

Sign LiveView upload tokens as :local to avoid node names being included in the token

Ensure async tasks exit gracefully in LiveView tests (#4348)

Allow opting focused form elements into DOM patching (#4339)

Bug fixes

Fix server close handler not being reattached after a manual disconnect + connect (#4341)

Fix detail.lock() promise in phx:push event never resolving (#4351)

Fix live components not being correctly patched when changing their DOM ID (#4338)

Gracefully handle missing upload refs (#4354)

Changelog

Sourced from phoenix_live_view's changelog.

v1.2.8 (2026-07-27)

Enhancements

Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.

Sign LiveView upload tokens as :local to avoid node names being included in the token

Ensure async tasks exit gracefully in LiveView tests (#4348)

Allow opting focused form elements into DOM patching (#4339)

Bug fixes

Fix server close handler not being reattached after a manual disconnect + connect (#4341)

Fix detail.lock() promise in phx:push event never resolving (#4351)

Fix live components not being correctly patched when changing their DOM ID (#4338)

Gracefully handle missing upload refs (#4354)

Commits

41b9a2c temporarily allow all git
883b9f6 fix npm publish
5ee5d49 Release v1.2.8
d46d8d3 Update assets
6b77658 Allow cancelling client-side live navigation (#4332)
c7cb976 Update assets
33a800d Namespace diagnostics (#4344)
58071f0 Skip unknown upload refs in form events so the LiveView channel survives (#4354)
c837809 Update assets
15a0271 Handle keyed root when patching live components (#4338)
Additional commits viewable in compare view

Updates req from 0.6.2 to 0.7.1

Changelog

Sourced from req's changelog.

v0.7.1 (2026-07-28)

Deprecate cache: true/[cache] step. It will be removed in Req v0.8. I plan a comprehensive cache solution for Req v1.0+.

v0.7.0 (2026-07-28)

[Req]: Add Req.new(req, options).

[Req]: Treat URL userinfo as Basic Authentication.

[Req], [Req.Request]: Deprecate adapter: fun in favour of adapter: mod.

[Req.Request]: (BREAKING CHANGE) Remove current_request_steps field.

[Req.Request]: Fix redacting remaining auth values.

(BREAKING CHANGE) Replace run_finch step with [Req.Finch] adapter module.

(BREAKING CHANGE) Replace put_plug and run_plug steps with [Req.Plug] adapter module.

[Req.Finch]: Support finch: options.

[Req.Finch]: Support :request_timeout.

[Req.Finch]: Fix handling duplicate response headers.

[Req.Finch]: Deprecate finch: name in favour of finch: [name: name].

[Req.Finch]: Deprecate pool_timeout: value in favour of finch: [pool_timeout: value].

[Req.Finch]: Deprecate pool_max_idle_time: value in favour of finch: [pool_max_idle_time: value].

[Req.Finch]: Deprecate :finch_request.

[Req.Plug]: Handle individual response body chunks.

[Req.Plug]: Support non-UTF8 request params.

[Req.Plug]: Put original request private data in conn.private.

[Req.Test]: Allow descendant processes.

[Req.Test]: Fix concurrent plug fetches immediately after switching to shared mode.

[compress_body]: Do nothing when request content-encoding is already set.

[compress_body]: Update multipart boundary when re-running the step.

[compressed], [decode_body]: Replace optional ezstd dependency with Erlang/OTP 28+ built-in :zstd.

... (truncated)

Commits

168a11e Release v0.7.1
a9c24a1 Deprecate cache: true/cache step
6a4f305 Release v0.7.0
d770830 Hide body: fun for now
e450b25 Update CI
8123419 Fix flaky httpc into: fun test
fb7bb10 Revert "New step: expect (#493)"
ed894af Revert "Add assigns (#492)"
c47a208 Update docs
be40081 Req.Finch: Deprecate :finch_request
Additional commits viewable in compare view

Updates swoosh from 1.26.3 to 1.27.0

Release notes

Sourced from swoosh's releases.

v1.27.0 🚀

✨ Features

Add AhaSend adapter @Sameer1122 (#1177)

📝 Documentation

docs: document SMTP tls_options for certificate verification @mvanhorn (#1173)

New Contributors

@mvanhorn made their first contribution in swoosh/swoosh#1173

@Sameer1122 made their first contribution in swoosh/swoosh#1177

Full Changelog: swoosh/swoosh@v1.26.3...v1.27.0

Changelog

Sourced from swoosh's changelog.

1.27.0

✨ Features

Add AhaSend adapter @Sameer1122 (#1177)

Commits

ae80fbe Prepare 1.27.0 minor release files
96345a9 docs: flag EU-exclusive and GDPR-only adapters in the README
f6e1b52 Add AhaSend adapter (#1177)
e937dbb build(deps): bump plug_cowboy from 2.8.1 to 2.9.0 (#1168)
16e8b0f build(deps): bump cowboy from 2.16.1 to 2.17.0 (#1170)
ba0d5a2 build(deps): bump hackney from 4.4.5 to 4.5.2 (#1172)
416e0b9 build(deps): bump plug from 1.20.1 to 1.20.3 (#1174)
9b5c3b3 docs: document SMTP tls_options for certificate verification (#1173)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the elixir-dependencies group with 7 updates: | Package | From | To | | --- | --- | --- | | [bandit](https://github.com/mtrudel/bandit) | `1.12.0` | `1.12.4` | | [lazy_html](https://github.com/dashbitco/lazy_html) | `0.1.11` | `0.1.12` | | [mdex](https://github.com/leandrocp/mdex) | `0.13.3` | `0.13.5` | | [phoenix_live_reload](https://github.com/phoenixframework/phoenix_live_reload) | `1.6.2` | `1.7.0` | | [phoenix_live_view](https://github.com/phoenixframework/phoenix_live_view) | `1.2.7` | `1.2.8` | | [req](https://github.com/wojtekmach/req) | `0.6.2` | `0.7.1` | | [swoosh](https://github.com/swoosh/swoosh) | `1.26.3` | `1.27.0` | Updates `bandit` from 1.12.0 to 1.12.4 - [Changelog](https://github.com/mtrudel/bandit/blob/main/CHANGELOG.md) - [Commits](mtrudel/bandit@1.12.0...1.12.4) Updates `lazy_html` from 0.1.11 to 0.1.12 - [Release notes](https://github.com/dashbitco/lazy_html/releases) - [Changelog](https://github.com/dashbitco/lazy_html/blob/main/CHANGELOG.md) - [Commits](dashbitco/lazy_html@v0.1.11...v0.1.12) Updates `mdex` from 0.13.3 to 0.13.5 - [Release notes](https://github.com/leandrocp/mdex/releases) - [Changelog](https://github.com/leandrocp/mdex/blob/main/CHANGELOG.md) - [Commits](leandrocp/mdex@v0.13.3...v0.13.5) Updates `phoenix_live_reload` from 1.6.2 to 1.7.0 - [Changelog](https://github.com/phoenixframework/phoenix_live_reload/blob/main/CHANGELOG.md) - [Commits](phoenixframework/phoenix_live_reload@v1.6.2...v1.7.0) Updates `phoenix_live_view` from 1.2.7 to 1.2.8 - [Release notes](https://github.com/phoenixframework/phoenix_live_view/releases) - [Changelog](https://github.com/phoenixframework/phoenix_live_view/blob/main/CHANGELOG.md) - [Commits](phoenixframework/phoenix_live_view@v1.2.7...v1.2.8) Updates `req` from 0.6.2 to 0.7.1 - [Release notes](https://github.com/wojtekmach/req/releases) - [Changelog](https://github.com/wojtekmach/req/blob/main/CHANGELOG.md) - [Commits](wojtekmach/req@v0.6.2...v0.7.1) Updates `swoosh` from 1.26.3 to 1.27.0 - [Release notes](https://github.com/swoosh/swoosh/releases) - [Changelog](https://github.com/swoosh/swoosh/blob/main/CHANGELOG.md) - [Commits](swoosh/swoosh@v1.26.3...v1.27.0) --- updated-dependencies: - dependency-name: bandit dependency-version: 1.12.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: elixir-dependencies - dependency-name: lazy_html dependency-version: 0.1.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: elixir-dependencies - dependency-name: mdex dependency-version: 0.13.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: elixir-dependencies - dependency-name: phoenix_live_reload dependency-version: 1.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: elixir-dependencies - dependency-name: phoenix_live_view dependency-version: 1.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: elixir-dependencies - dependency-name: req dependency-version: 0.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: elixir-dependencies - dependency-name: swoosh dependency-version: 1.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: elixir-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

zorn · 2026-08-01T22:04:11Z

Superseded by #184, which landed the same 12 package updates at the same versions (merged in 46ddf61). Closing as redundant.

dependabot · 2026-08-01T22:04:13Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code labels Aug 1, 2026

zorn closed this Aug 1, 2026

zorn deleted the dependabot/hex/elixir-dependencies-67f8d7dedd branch August 1, 2026 22:04

Navigation Menu

chore(deps): bump the elixir-dependencies group with 7 updates - #183

chore(deps): bump the elixir-dependencies group with 7 updates#183
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/elixir-dependencies-67f8d7dedd

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

zorn commented Aug 1, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 1, 2026

1.12.4 (27 July 2026)

Fixes

Enhancements

1.12.3 (25 July 2026)

Enhancements

1.12.2 (25 July 2026)

Enhancements

Fixes

1.12.1 (24 July 2026)

Fixes

v0.1.12

Changed

v0.13.5

0.13.5 (2026-07-29)

Bug Fixes

v0.13.4

0.13.4 (2026-07-17)

Changes

Features

0.13.5 (2026-07-29)

Bug Fixes

0.13.4 (2026-07-17)

Changes

Features

1.7.0 (2026-07-29)

v1.2.8

Enhancements

Bug fixes

v1.2.8 (2026-07-27)

Enhancements

Bug fixes

v0.7.1 (2026-07-28)

v0.7.0 (2026-07-28)

v1.27.0 🚀

✨ Features

📝 Documentation

New Contributors

1.27.0

✨ Features

Uh oh!

zorn commented Aug 1, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant