ash_replicant 1.6.3

Security

• Require Ash >= 3.34.6 and < 4.0.0-0. This excludes
  EEF-CVE-2026-94201 (atom-table exhaustion when filtering an atom
  attribute with unsafe_to_atom?, fixed in Ash 3.34.3) and
  EEF-CVE-2026-101028 (related-resource read-policy bypass in
  Ash.count, Ash.exists, and Ash.aggregate, fixed in Ash 3.34.6).
• Lock Decimal 3.2.0 (from 3.1.1), clearing EEF-CVE-2026-97853
  (unbounded allocation in Decimal.round/3).

Breaking dependency change

• Consumers locked below Ash 3.34.6 must update Ash and Spark. Ash requires
  Spark 2.7.6 or later; the public Spark requirement remains ~> 2.7.0.

Fixed

• mix ash_replicant.upgrade renders the checkpoint resource snapshot in the
  host's AshPostgres shape, so its hash matches the host's generator:
  AshPostgres 2.14 adds the temporal key, 2.13 has none.

Changed

• Lock Ash 3.33.11 → 3.34.6, Spark 2.7.3 → 2.7.6, and
  AshOnetime 1.4.0 → 1.5.0, AshPostgres 2.13.1 → 2.14.5 and AshSql
  0.7.6 → 0.8.1. The public AshPostgres requirement stays ~> 2.13. The
  test repository adds AshPostgres 2.14's ash-functions version 7
  migration (ash_required/2 redefined in place).
  Other resolver moves: ex_ast 0.13.1 → 0.16.0, Finch 0.23.0 → 0.24.0,
  Req 0.7.4 → 0.7.5, and Sourceror 1.12.3 → 1.12.4.
• The latest-compatible CI cell unlocks the entire dependency graph and
  checks Ash, Replicant, AshOnetime, AshPostgres, and Spark against the
  newest non-retired stable Hex release within each requirement.
• Guard publish and verification with a clean tree and HEAD equal to the
  version tag. Publish clears all dependency selectors and loads
  HEX_API_KEY from the repo-root .env. Inspect package files against a
  checked-in allowlist; run the fresh-consumer check in prepush.sh and
  support --from-hex VERSION after publication.
• Exclude Cloak's AES-CTR advisory EEF-CVE-2026-95105 from Hex audits while
  test/cloak_cipher_guard_test.exs enforces AES-GCM across lib, config,
  and test/support. Remove the exception and upgrade when a fixed release ships.