chore(deps): update mix dependencies #562
No reviewers
Labels
No labels
bug
duplicate
enhancement
help wanted
high priority
invalid
L
low priority
M
medium priority
needs refinement
optional
question
S
technical improvement
UX Improvement
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
local-it/mitgliederverwaltung!562
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/mix-dependencies"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
3.29.3→3.31.21.1.0→1.2.0~> 4.13.0→~> 4.14.02.16.0→2.17.22.3.22→2.3.242.10.0→2.11.01.12.0→1.12.41.7.18→1.7.197.3.0→7.4.00.8.2→0.8.30.1.11→0.1.121.0.0→1.0.21.8.8→1.8.91.6.2→1.7.01.2.5→1.2.80.22.2→0.22.4~> 0.6→~> 0.7~> 0.14→~> 0.151.25.1→1.27.0~> 0.6→~> 0.80.28.1→0.28.2Release Notes
ash-project/ash (ash)
v3.31.2Compare Source
Bug Fixes:
:allow_forbidden_field_for_relationships_by_default?by @zachdanielv3.31.1Compare Source
Bug Fixes:
limit keyset binary size by @zachdaniel
Patches CVE-2026-69659 https://github.com/ash-project/ash/security/advisories/GHSA-j35q-v8h8-7mwq
sanitize managed relationship lookup filters by @zachdaniel
Patches CVE-2026-69659 https://github.com/ash-project/ash/security/advisories/GHSA-j35q-v8h8-7mwq
resolve bulk index from changeset in after_batch filter (#2842) by @emadshaaban92 (#2842)
ci: pass --all to
mix igniter.upgrade(#2841) by @jimsynz (#2841)report the primary key in the combination fieldset (#2836) by @matt-beanland (#2836)
resolve a combinations reference in the outer filter (#2838) by @matt-beanland (#2838)
dispatch on whether a comparator is implemented (#2840) by @matt-beanland (#2840)
decide an ETS aggregate is empty after rejecting nil values (#2833) by @matt-beanland (#2833)
compare the combination fieldset by name so shadowing calcs are applied (#2830) by @matt-beanland (#2830)
sort a ranked union in ETS, not only a ranked union_all (#2828) by @matt-beanland (#2828)
order ETS min/max aggregates with Comp instead of Erlang term order (#2824) by @matt-beanland (#2824)
reset the combinations accumulator after an intersect in ETS (#2822) by @matt-beanland (#2822)
ci: reference the unused-deps input by its declared name by @joshprice (#2813)
allow_forbidden_field_for_relationships_by_default? missing the ? (#2812) by @frankdugan3 (#2812)
Improvements:
memoize Comparable's type-pair dispatch in a release (#2819) by @matt-beanland (#2819)
index runtime_sort rekey by primary key instead of scanning by @matt-beanland (#2818)
v3.31.0Compare Source
Features:
add units constraint to Ash.Type.Duration (#2811) by @matt-beanland (#2811)
add mfa constraint to Ash.Type.Function for portable persistence (#2807) by @matt-beanland (#2807)
add all/1 builtin validation as the complement to any/1 (#2800) by @barnabasJ (#2800)
Bug Fixes:
order durations semantically instead of by struct field layout (#2809) by @matt-beanland (#2809)
compare with
Compinintersectsfunction by @zachdanielensure related aggregates set the proper resource by @zachdaniel
enforce sortable fasle consistently (#2793) by Dominik (#2793)
Improvements:
avoid quadratic cost evaluating in-list filters at runtime (#2802) by @matt-beanland (#2802)
add strict? constraint to Ash.Type.UUIDv7 (#2795) by olivermt (#2795)
v3.30.1Compare Source
Bug Fixes:
Ash.Type.loadon array returns by @zachdanielv3.30.0Compare Source
Features:
pass relationship read action arguments (#2775) by @jechol (#2775)
support for aggregated Policy evaluation (#2778) by CyanideDragon (#2778)
add action_changes function to combine global and action-specific changes by Aaron Heiner (#2776)
mix: add
mix ash.set.domainsconfiguration task via Igniter (#2762) by Okoye (Nature) Andrew (#2762)Bug Fixes:
expand calculations no matter where they appear by @zachdaniel
use final relationship read action for aggregates (#2792) by @jechol (#2792)
fix negate atomic validation field interpolation (#2787) by @stevebrambilla (#2787)
propagate shared context when loading bulk create results (#2783) by @nallwhy (#2783)
don't clobber bulk destroy context by @zachdaniel
don't carry over query context to changesets by @zachdaniel
ensure manual action module is loaded before bulk dispatch (#2768) by diogomrts (#2768)
on_match :destroy for many_to_many now destroys both join and destination (#2638) by @nallwhy (#2638)
manifest reachability for repeated action roots (#2766) by olivermt (#2766)
pass NotLoaded/ForbiddenField through Ash.Type.rewrite/4 for array types (#2765) by Oshoma Momoh (#2765)
load and rewrite array-member union types correctly (#2763) by skanderm (#2763)
Improvements:
redact keyset values in
InvalidKeysetmessages (#2788) by nseaSeb (#2788)add
error_handlerto generic actions (#2782) by @jimsynz (#2782)add default_bulk_batch_size data layer callback(#2780) by alfieV (#2780)
Syntax Error for Exists improved #2274 (#2767) by torazar (#2767)
support predicate (question mark endings) in code interfaces (#2761) by colenelson0 (#2761)
ash-project/ash_admin (ash_admin)
v1.2.0Compare Source
Features:
Bug Fixes:
support tenant option labels (#406) by Jakub Skałecki
Ensure mobile and desktiop sidebar ids are unique (#404) by capoccias
update for LV 1.2.0 by Zach Daniel
format array attribtues in ash_admin by Zach Daniel
Improvements:
team-alembic/ash_authentication_phoenix (ash_authentication_phoenix)
v2.17.2Compare Source
Breaking Changes:
Bug Fixes:
add form IDs for liveview forms (#759) by @jimsynz (#759)
read session data from Plug session in generate_session (#716) (#747) by @jimsynz (#747)
Improvements:
ConfirmationRequiredin the generated auth controller (#744) by @jimsynz (#744)v2.17.1Compare Source
v2.17.0Compare Source
ash-project/ash_phoenix (ash_phoenix)
v2.3.24Compare Source
Bug Fixes:
v2.3.23Compare Source
Bug Fixes:
unwrap
NewTypein auto-formmap_type?check (#475) by sevenseacat (#475)Skip embed form standalone validation (#474) by sevenseacat (#474)
propagate shared context to nested forms in add_form and validate (#472) by @nallwhy (#472)
ash-project/ash_postgres (ash_postgres)
v2.11.0Compare Source
Features:
Bug Fixes:
fix generated reference type value for identity and bigserial (#800) by Dmitry Maganov
return skipped upserts with nil identity values (#794) by Jechol Lee
warn when resources are skipped due to migrate?: false during mi⦠(#792) by Jsime34
set tenant on destroy so exists() subqueries resolve against the tenant schema (#790) by Francisco-Castro
resolve actor/context templates in through relationship filters (#789) by Barnabas Jovanovics
correlate bulk upsert records by identity on the MERGE path (#786) by Johannes Welebil
ensure timeouts applied at repo level (#784) by torazar
Improvements:
Add partial index conditions for references (#795) by Jechol Lee
avoid generating uuidv7 by default, once postgres v18 is detected (#793) by Luca Venir
Added sort direction support to custom_indexes fields. (#775) by Thomas Lucas
mtrudel/bandit (bandit)
v1.12.4Compare Source
Fixes
Enhancements
v1.12.3Compare Source
Enhancements
v1.12.2Compare Source
Enhancements
Fixes
(https://github.com/mtrudel/bandit/security/advisories/GHSA-rhh8-5xw9-c3gm,
thanks @lukaszsamson!)
(https://github.com/mtrudel/bandit/security/advisories/GHSA-9q5m-g6v3-6772,
thanks @lukaszsamson!)
v1.12.1Compare Source
Fixes
rrrene/credo (credo)
v1.7.19Compare Source
ExHammer/hammer (hammer)
v7.4.0Compare Source
:fix_window_per_keyalgorithm for ETS and Atomic backends — a fixed-window variant whose window is anchored to first hit per key instead of a globally-aligned wall-clock epoch. Same one-entry-per-key memory profile as:fix_window. The 2x boundary burst is still possible per key, but boundaries are no longer globally synchronized. (#181)ash-project/igniter (igniter)
v0.8.3Compare Source
Bug Fixes:
ensure verbose is passed all the way down by Zach Daniel
properly check
igniter.rmsin--checkby Zach Danielresolve Elixir 1.20 type-check warnings (#387) by Gilbert
Improvements:
add
Igniter.Libs.Phoenix.web_module_for_router/2(#393) by James Hartonupdate to Elixir 1.20 (#391) by ESmithByui
direct users to format command for unless refactor by Zach Daniel
dashbitco/lazy_html (lazy_html)
v0.1.12Compare Source
Changed
elixir_makerequirement (#35)software-mansion/live-debugger (live_debugger)
v1.0.2Compare Source
Bug fixes
v1.0.1Compare Source
Enhancements
Bug fixes
phoenixframework/phoenix (phoenix)
v1.8.9Compare Source
phoenixframework/phoenix_live_reload (phoenix_live_reload)
v1.7.0Compare Source
phoenixframework/phoenix_live_view (phoenix_live_view)
v1.2.8Compare Source
Enhancements
You can now listen for the
phx:before-navigateevent and callevent.preventDefault()to cancel the navigation synchronously.This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a
beforeunloadlistener.:localto avoid node names being included in the tokenBug fixes
detail.lock()promise inphx:pushevent never resolving (#4351)v1.2.7Compare Source
Security fixes
Phoenix.LiveView.Utilsv1.2.6Compare Source
Bug fixes
elixir-ecto/postgrex (postgrex)
v0.22.4Compare Source
Postgrex.stream/4(CVE-2026-66838)v0.22.3Compare Source
Postgrex.Notifications.listen/3(CVE-2026-58225)wojtekmach/req (req)
v0.7.2Compare Source
encode_body]: Bring backform_multipart: [{string_name, value}].put_aws_sigv4]: Fix AWS SigV4 compatibility with Supabase Storage S3.v0.7.1Compare Source
cache: true/[cache] step. It will be removed in Req v0.8. I plan a comprehensive cache solution for Req v1.0+.v0.7.0Compare Source
[
Req]: AddReq.new(req, options).[
Req]: Treat URL userinfo as Basic Authentication.[
Req], [Req.Request]: Deprecateadapter: funin favour ofadapter: mod.[
Req.Request]: (BREAKING CHANGE) Removecurrent_request_stepsfield.[
Req.Request]: Fix redacting remaining auth values.(BREAKING CHANGE) Replace
run_finchstep with [Req.Finch] adapter module.(BREAKING CHANGE) Replace
put_plugandrun_plugsteps with [Req.Plug] adapter module.[
Req.Finch]: Supportfinch: options.[
Req.Finch]: Support:request_timeout.[
Req.Finch]: Fix handling duplicate response headers.[
Req.Finch]: Deprecatefinch: namein favour offinch: [name: name].[
Req.Finch]: Deprecatepool_timeout: valuein favour offinch: [pool_timeout: value].[
Req.Finch]: Deprecatepool_max_idle_time: valuein favour offinch: [pool_max_idle_time: value].[
Req.Finch]: Deprecate:finch_request.[
Req.Plug]: Handle individual response body chunks.[
Req.Plug]: Support non-UTF8 request params.[
Req.Plug]: Put original request private data inconn.private.[
Req.Test]: Allow descendant processes.[
Req.Test]: Fix concurrent plug fetches immediately after switching to shared mode.[
compress_body]: Do nothing when request content-encoding is already set.[
compress_body]: Update multipart boundary when re-running the step.[
compressed], [decode_body]: Replace optionalezstddependency with Erlang/OTP 28+built-in
:zstd.[
decode_body]: Deprecate:decode_jsonin favour of setting a custom JSONdecoder via
:decoders:before:
after:
[
encode_body]: (BREAKING CHANGE) Automatically change GET to POST when request body is set.[
put_aws_sigv4]: Excludeaccept-encoding,x-amzn-trace-id, andhop-by-hop headers from the signature.
[
put_aws_sigv4]: Correctly sign duplicate header values.[
put_params]: (BREAKING CHANGE) Overwrite existing query params instead of appending.[
put_path_params]: Preserve the path template when re-running the step.[
redirect]: Strip userinfo from redirect locations and log a warning.Previously, redirecting to a URL with userinfo (e.g.
http://user:pass@host)kept the userinfo in the request URL (without converting it to auth). It is
now dropped so credentials supplied by the redirecting server aren't sent.
[
redirect]: Clear the request body, body options, and content headers whenchanging POST to GET after a 301, 302, or 303 response.
[
retry]: Use jitter by default.[
retry]: Honor configured:retry_delayoverRetry-After.(BREAKING CHANGE) Remove deprecated
follow_redirectsstep.(BREAKING CHANGE) Remove deprecated
outputstep.Require Elixir 1.15 or later.
v0.6.3Compare Source
Req.Test]: Fix__fetch_plug__/1when called immediately after switching to shared mode.sobelow/sobelow (sobelow)
v0.15.0Compare Source
Config.Secretsno longer crashes the scan when a secret is written asanything other than a plain double-quoted string. Heredoc values and values
containing escaped quotes previously raised a
MatchErrorand aborted theentire run. These secrets are now reported, using the line of the enclosing
configcall.Sobelow previously printed "This does not appear to be a Phoenix application"
and exited 0 — a CI gate could pass having scanned nothing.
--strictnow reports syntax errors instead of raising. It has been brokensince Elixir 1.13 changed the error shape returned by
Code.string_to_quoted/2. Errors are now reported asfile:line:column:.--strict) rather than aborting the scan with anEEx.SyntaxError. Theerror now names the offending template instead of
nofile..sobelow-confnow produces an actionable message instead of araw
MatchErrorstacktrace. This mattered more since v0.14.1 began readingthe file automatically.
.sobelow-confis now read asno options rather than aborting the scan. Such a file parses to an empty
block instead of a keyword list, so it originally crashed with a
FunctionClauseErrorand then, once that was fixed, exited 1 with aconfiguration error. Since the file is read automatically, a stray
touch .sobelow-confor a truncated write was enough to break every scanin a project. Contents that cannot be interpreted are still an error.
--save-confignow storesignore_filesrelative to the project root.Absolute paths were previously baked into
.sobelow-conf, breaking thecommitted file on every other machine and in CI.
Config.Secretsnow reports the line of the secret itself when aconfigcall spans multiple lines. The line search compared a tuple against an
integer, so it never worked as intended.
~/.sobelowno longer fails a scan.conn.${atom_to_string(field)}..sobelow-confkeys are now genuinely sorted alphabetically..sobelow-confcan no longer stop Sobelow from scanning.--save-configwrote
versioninto every file it generated, somix sobelow --version --save-configproduced a committed file that madeevery later run print the version and exit 0 — a CI gate reading that
as a clean scan.
version,details,all-details,save-config, anddiffchoose what Sobelow does rather than configure a scan, and are nowaccepted on the command line only. One in the file is ignored, with a
warning when it would have changed anything.
versionis no longerwritten to the file in the first place.
# sobelow_skipcomments are no longer thrown away over whitespace. Thepattern demanded exactly one space after the
#and exactly one beforethe list, so
# sobelow_skip["XSS.Raw"],# sobelow_skip ["XSS.Raw"],and
# sobelow_skip [ "XSS.Raw" ]were all ignored — silently, andindistinguishably from a skip that had simply not applied. Spacing around
the marker, inside the list, and around commas is now irrelevant.
SQL.Queryno longer reports a project's ownquery/1as SQL injection.An unqualified
query/query!call was matched regardless of what itreferred to, so every call to a local function that happened to carry one
of those very ordinary names produced a finding. The unqualified form is
now only considered in a file that has
import Ecto.Adapters.SQLoruse Ecto.Repo— the two ways the bare name can actually reach Ecto.Qualified calls, such as
Repo.query/1andEcto.Adapters.SQL.query/3,are unaffected.
--no-router, for scanning a project that has no Phoenix router.Sobelow warned that it could not find one and offered no way to silence it,
which was noise for plain Elixir libraries. It is shorthand for
--router :none, which can also be set in.sobelow-confasrouter: :none. The router-dependent checks are skipped either way..sobelow-skipsis now written in sorted order, so regenerating it afterfixing or adding a finding produces a small diff instead of reshuffling the
file. Entries sort by type, file, and line number — numerically, so line 10
follows line 9 rather than line 1. The whole file is sorted, not just the
newly added entries, so the ordering holds however many times it is
regenerated. Comments and pre-v0.14 bare-fingerprint lines are preserved.
Pass
--legacy-skipsfor the previous append-only behaviour, which neverrewrites lines it did not add.
# sobelow_skipcomments now work on Phoenix router pipelines, not justfunctions. This makes
Config.CSRF,Config.Headers, andConfig.CSPsuppressible per pipeline instead of only via
--mark-skip-all, so an APIpipeline that legitimately has no
:protect_from_forgerycan be annotatedin place. Listing the parent
Configmodule skips every Config check onthat pipeline. As with function-level skips, this only takes effect under
--skip.# sobelow_skipcomment that cannot be read now warns on stderr, namingthe file and line, instead of being dropped without a word. Single quotes
and a list broken across several comment lines are still not accepted, but
they now say so rather than leaving you to wonder why the finding came
back.
--privatenow skips the version check entirely rather than still writingthe cache file. It makes no network requests and touches no files outside
the scanned project.
SOBELOW_HOMEis now documented, and is treated as the directory holdingthe version-check cache.
usage-rules.md, following theusage_rulesconvention, so projectsusing AI coding assistants can pull Sobelow's guidance into their agent's
context with
mix usage_rules.sync. It is shipped in the Hex package.AGENTS.mddocumenting the checker-module contract for contributors.Sobelow.ScanCase) that runs full scansagainst fixture applications under
test/fixtures/apps, plus regressioncoverage for every bug above. Line coverage went from 29% to 67%.
.sobelow-confprecedence,--exitand
--thresholdmapping, and thejson/sarif/quiet/txtrenderers.# sobelow_skipcomments, andunit coverage for how skips associate with pipelines in the AST.
Sobelow.ScanCase.temp_fixture_file/3now restores a committed fixture'soriginal contents instead of deleting the file, so a test can vary a
checked-in fixture without destroying it.
:preferred_cli_envproject key withdef cli.credoto~> 1.7.19; 1.7.12 crashed on Elixir 1.20.in the SARIF renderer.
Upgrade notes
Config.Secretsline numbers may change forconfigcalls that spanmultiple lines, and for files where the same secret value appears more than
once. Finding fingerprints include the line number, so any affected
.sobelow-skipsentries will stop matching and those findings will resurface.Re-run
mix sobelow --mark-skip-allif you rely on a committed skip file.escaped-quote secret exists in your config, you will see new findings where the
scan previously failed outright.
SOBELOW_HOMEsemantics changed from "path to the cache file" to "directoryholding the cache file". The previous behaviour raised a
MatchErrorfor thenatural usage, so this is unlikely to affect anyone.
swoosh/swoosh (swoosh)
v1.27.0Compare Source
✨ Features
v1.26.3Compare Source
🔒 Security
v1.26.2Compare Source
🐛 Bug Fixes
v1.26.1Compare Source
🐛 Bug Fixes
cidhandling for Mailpit adapter @waseigo (#1155)v1.26.0Compare Source
✨ Features
📝 Documentation
v1.25.3Compare Source
📝 Documentation
🧰 Maintenance
v1.25.2Compare Source
🐛 Bug Fixes
tidewave-ai/tidewave_phoenix (tidewave)
v0.8.2action_inputsforbrowser_evalv0.8.1Compare Source
v0.8.0Compare Source
mathieuprog/tz (tz)
v0.28.2Compare Source
Configuration
📅 Schedule: (UTC)
* * 1-7 * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.
⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
File name: mix.lock
f8fbb2f5232186e25dc4View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.