Skip to content

Bump the mix-minor-and-patch group with 5 updates - #35

Merged
andreogle merged 1 commit into
mainfrom
dependabot/hex/mix-minor-and-patch-0fe26c7ba3
Jul 30, 2026
Merged

Bump the mix-minor-and-patch group with 5 updates#35
andreogle merged 1 commit into
mainfrom
dependabot/hex/mix-minor-and-patch-0fe26c7ba3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the mix-minor-and-patch group with 5 updates:

Package From To
bandit 1.12.0 1.12.4
phoenix_live_reload 1.6.2 1.7.0
phoenix_live_view 1.2.7 1.2.8
req 0.6.3 0.7.1
swoosh 1.26.3 1.27.0

Updates bandit from 1.12.0 to 1.12.4

Changelog

Sourced from bandit's changelog.

1.12.4 (27 July 2026)

Fixes

  • Properly send Connection: close header when client requests closure (#617)
  • Disallow transfer-encoding on HTTP/1.0 connections (#618)
  • Reject requests with multiple Host headers (#619)
  • Reject malformed header lines (#620)
  • Fix handling of chunk extensions (#621)

Enhancements

  • Tighten up CI against supply chain attacks (#623, thanks @​Totara-thib!)
  • Reorganize and increase coverage of HTTP/1 tests to better match RFC structure (#616)
  • Tolerate a leading newline on HTTP/1 requests (#622)
  • Send "100 Continue" interim response before reading body if client requests it (#624)

1.12.3 (25 July 2026)

Enhancements

  • Cache connection-level data between HTTP/1 keepalives (#603, thanks @​preciz!)

1.12.2 (25 July 2026)

Enhancements

  • Improve internal HTTP/2 error handling to be better about closing stream/connection
  • Coalesce header and body in to single transport send (#606, thanks @​NelsonVides!)
  • Improve compression behaviour when streaming an explicitly length delimited body (#605, thanks @​elibosley!)
  • Quiet WebSocket deserialization erorrs, add verbosity config lever (#610, thanks @​ericmj!)
  • Send connection: close when we're at max_requests (#613, thanks @​joshdchang!)

Fixes

1.12.1 (24 July 2026)

Fixes

  • Fix DoS issue with fragmented WebSocket frames (CVE-2026-65623, thanks @​PJUllrich!)
Commits
  • 00d532f Version bump to 1.12.4
  • 1663203 Handle clients sending an Expect: 100-continue header before sending a body...
  • e3c6595 Fixup linting error
  • c430bf5 Reapply "Pin GitHub Actions to commit SHAs (#623)"
  • a6fabe8 Revert "Pin GitHub Actions to commit SHAs (#623)"
  • e479c3b Pin GitHub Actions to commit SHAs (#623)
  • eba04e4 Tolerate a leading empty line before the request line (RFC9112§2.2) (#622)
  • c31e9e3 Fix crash on unrecognized chunk extensions (#621)
  • c24bc00 Reject header values containing CR, LF, or NUL (#620)
  • a518b29 Reject requests with multiple Host headers (#619)
  • Additional commits viewable in compare view

Updates phoenix_live_reload from 1.6.2 to 1.7.0

Changelog

Sourced from phoenix_live_reload's changelog.

1.7.0 (2026-07-29)

  • Enhancements
    • Add JavaScript helper function to capture keyboard shortcuts to open HEEx components
    • Forward log events to window for custom behaviour
Commits

Updates phoenix_live_view from 1.2.7 to 1.2.8

Release notes

Sourced from phoenix_live_view's releases.

v1.2.8

Enhancements

  • Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
  • Sign LiveView upload tokens as :local to avoid node names being included in the token
  • Ensure async tasks exit gracefully in LiveView tests (#4348)
  • Allow opting focused form elements into DOM patching (#4339)

Bug fixes

  • Fix server close handler not being reattached after a manual disconnect + connect (#4341)
  • Fix detail.lock() promise in phx:push event never resolving (#4351)
  • Fix live components not being correctly patched when changing their DOM ID (#4338)
  • Gracefully handle missing upload refs (#4354)
Changelog

Sourced from phoenix_live_view's changelog.

v1.2.8 (2026-07-27)

Enhancements

  • Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
  • Sign LiveView upload tokens as :local to avoid node names being included in the token
  • Ensure async tasks exit gracefully in LiveView tests (#4348)
  • Allow opting focused form elements into DOM patching (#4339)

Bug fixes

  • Fix server close handler not being reattached after a manual disconnect + connect (#4341)
  • Fix detail.lock() promise in phx:push event never resolving (#4351)
  • Fix live components not being correctly patched when changing their DOM ID (#4338)
  • Gracefully handle missing upload refs (#4354)
Commits

Updates req from 0.6.3 to 0.7.1

Changelog

Sourced from req's changelog.

v0.7.1 (2026-07-28)

  • Deprecate cache: true/[cache] step. It will be removed in Req v0.8. I plan a comprehensive cache solution for Req v1.0+.

v0.7.0 (2026-07-28)

  • [Req]: Add Req.new(req, options).

  • [Req]: Treat URL userinfo as Basic Authentication.

  • [Req], [Req.Request]: Deprecate adapter: fun in favour of adapter: mod.

  • [Req.Request]: (BREAKING CHANGE) Remove current_request_steps field.

  • [Req.Request]: Fix redacting remaining auth values.

  • (BREAKING CHANGE) Replace run_finch step with [Req.Finch] adapter module.

  • (BREAKING CHANGE) Replace put_plug and run_plug steps with [Req.Plug] adapter module.

  • [Req.Finch]: Support finch: options.

  • [Req.Finch]: Support :request_timeout.

  • [Req.Finch]: Fix handling duplicate response headers.

  • [Req.Finch]: Deprecate finch: name in favour of finch: [name: name].

  • [Req.Finch]: Deprecate pool_timeout: value in favour of finch: [pool_timeout: value].

  • [Req.Finch]: Deprecate pool_max_idle_time: value in favour of finch: [pool_max_idle_time: value].

  • [Req.Finch]: Deprecate :finch_request.

  • [Req.Plug]: Handle individual response body chunks.

  • [Req.Plug]: Support non-UTF8 request params.

  • [Req.Plug]: Put original request private data in conn.private.

  • [Req.Test]: Allow descendant processes.

  • [Req.Test]: Fix concurrent plug fetches immediately after switching to shared mode.

  • [compress_body]: Do nothing when request content-encoding is already set.

  • [compress_body]: Update multipart boundary when re-running the step.

  • [compressed], [decode_body]: Replace optional ezstd dependency with Erlang/OTP 28+ built-in :zstd.

... (truncated)

Commits

Updates swoosh from 1.26.3 to 1.27.0

Release notes

Sourced from swoosh's releases.

v1.27.0 🚀

✨ Features

📝 Documentation

New Contributors

Full Changelog: swoosh/swoosh@v1.26.3...v1.27.0

Changelog

Sourced from swoosh's changelog.

1.27.0

✨ Features

Commits
  • ae80fbe Prepare 1.27.0 minor release files
  • 96345a9 docs: flag EU-exclusive and GDPR-only adapters in the README
  • f6e1b52 Add AhaSend adapter (#1177)
  • e937dbb build(deps): bump plug_cowboy from 2.8.1 to 2.9.0 (#1168)
  • 16e8b0f build(deps): bump cowboy from 2.16.1 to 2.17.0 (#1170)
  • ba0d5a2 build(deps): bump hackney from 4.4.5 to 4.5.2 (#1172)
  • 416e0b9 build(deps): bump plug from 1.20.1 to 1.20.3 (#1174)
  • 9b5c3b3 docs: document SMTP tls_options for certificate verification (#1173)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the mix-minor-and-patch group with 5 updates
cd5a3a4 
Bumps the mix-minor-and-patch group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [bandit](https://github.com/mtrudel/bandit) | `1.12.0` | `1.12.4` |
| [phoenix_live_reload](https://github.com/phoenixframework/phoenix_live_reload) | `1.6.2` | `1.7.0` |
| [phoenix_live_view](https://github.com/phoenixframework/phoenix_live_view) | `1.2.7` | `1.2.8` |
| [req](https://github.com/wojtekmach/req) | `0.6.3` | `0.7.1` |
| [swoosh](https://github.com/swoosh/swoosh) | `1.26.3` | `1.27.0` |


Updates `bandit` from 1.12.0 to 1.12.4
- [Changelog](https://github.com/mtrudel/bandit/blob/main/CHANGELOG.md)
- [Commits](mtrudel/bandit@1.12.0...1.12.4)

Updates `phoenix_live_reload` from 1.6.2 to 1.7.0
- [Changelog](https://github.com/phoenixframework/phoenix_live_reload/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/phoenix_live_reload@v1.6.2...v1.7.0)

Updates `phoenix_live_view` from 1.2.7 to 1.2.8
- [Release notes](https://github.com/phoenixframework/phoenix_live_view/releases)
- [Changelog](https://github.com/phoenixframework/phoenix_live_view/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/phoenix_live_view@v1.2.7...v1.2.8)

Updates `req` from 0.6.3 to 0.7.1
- [Release notes](https://github.com/wojtekmach/req/releases)
- [Changelog](https://github.com/wojtekmach/req/blob/main/CHANGELOG.md)
- [Commits](wojtekmach/req@v0.6.3...v0.7.1)

Updates `swoosh` from 1.26.3 to 1.27.0
- [Release notes](https://github.com/swoosh/swoosh/releases)
- [Changelog](https://github.com/swoosh/swoosh/blob/main/CHANGELOG.md)
- [Commits](swoosh/swoosh@v1.26.3...v1.27.0)

---
updated-dependencies:
- dependency-name: bandit
  dependency-version: 1.12.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-minor-and-patch
- dependency-name: phoenix_live_reload
  dependency-version: 1.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: mix-minor-and-patch
- dependency-name: phoenix_live_view
  dependency-version: 1.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-minor-and-patch
- dependency-name: req
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-minor-and-patch
- dependency-name: swoosh
  dependency-version: 1.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code labels Jul 30, 2026
@dependabot
dependabot Bot requested a review from andreogle as a code owner July 30, 2026 11:55
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code labels Jul 30, 2026
@andreogle
andreogle merged commit 0af0cc5 into main Jul 30, 2026
5 checks passed
@dependabot
dependabot Bot deleted the dependabot/hex/mix-minor-and-patch-0fe26c7ba3 branch July 30, 2026 15:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andreogle andreogle Awaiting requested review from andreogle andreogle is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@andreogle