[dependabot]

Bumps the mix-minor-and-patch group with 6 updates in the /server directory:

Package	From	To
bandit	1.12.5	1.14.1
ecto_sqlite3	0.25.0	0.26.0
plug_crypto	2.2.0	2.2.1
req	0.7.4	0.7.5
sbom	0.11.0	0.12.0
sobelow	0.16.0	0.18.1

Updates bandit from 1.12.5 to 1.14.1

Changelog

Sourced from bandit's changelog.

1.14.1 (28 Oct 2026)

Changes

• Close an HTTP/1 connection after a 2xx response to CONNECT, as RFC 9110 §9.3.6 requires. Before, the connection stayed open and could serve a later request (#729, thanks @​neilberkman!)
• Reject an HTTP/2 request whose host header does not match :authority, or that has more than one host header, with a stream PROTOCOL_ERROR (RFC 9113 §8.3.1) (#725, thanks @​neilberkman!)
• Remove connection-specific header fields (connection, keep-alive, proxy-connection, transfer-encoding and upgrade) from HTTP/2 responses, as RFC 9113 §8.2.2 requires. Before, clients such as curl and Firefox reset the stream (#728, thanks @​mpettibone!)

Fixes

• Collect HTTP/2 request bodies into one binary, so that a body sent as many tiny DATA frames no longer uses many times its size in memory (GHSA-pxjf-g536-7r93, thanks @​neilberkman!)
• Read Accept-Encoding q-values with the RFC 9110 §12.4.2 grammar. Before, a q-value with a very long integer part caused a 500 on every request (#733, thanks @​mpettibone!)
• Remove trailing whitespace from HTTP/1 header values (RFC 9110 §5.5). Before, a Host header with a trailing space got a 400 (#731, thanks @​mpettibone!)
• Reject an IPv6 literal authority with no colon before the port (for example [::1]80) (RFC 3986 §3.2) (#730, thanks @​neilberkman!)
• Send RST_STREAM for an oversized HTTP/2 header block as a stream error, and keep the HPACK decoder state (RFC 9113 §5.4.2) (#726, thanks @​neilberkman!)

1.14.0 (26 Oct 2026)

Changes

• Advertise a default HTTP/2 max_concurrent_streams of 500 and a default max_header_list_size of 262144 bytes in the initial SETTINGS frame. Before, both were unlimited. The entries of a SETTINGS frame are now sorted
• Refill the HTTP/2 connection receive window to 16 MiB as data arrives. Refill a stream receive window to 1 MiB only after the stream reads data. Before, the server granted 2^31-1 bytes on the first DATA frame
• Join HTTP/2 DATA frames into larger messages when a stream is slow to read. As a result, read_body can return more than :length bytes, up to the stream receive window
• Reset an HTTP/2 stream with ENHANCE_YOUR_CALM when it has 100 unread messages, and close the connection with ENHANCE_YOUR_CALM when a client sends more than 100 non-ACK SETTINGS frames in 10 seconds
• Reset an HTTP/2 stream with STREAM_CLOSED when the client sends DATA or HEADERS after END_STREAM
• Send PROTOCOL_ERROR for DATA, WINDOW_UPDATE and RST_STREAM on an idle HTTP/2 stream, and report the last stream that the server started in the GOAWAY frame
• Reject an HTTP/1 absolute-form request target whose path :erlang.decode_packet/3 reads differently from RFC 3986. As a result, a target with an empty path followed by a query (for example http://host:80?a=b) now gets 400. Before, its query was silently discarded
• Require the HTTP/1 request line to have exactly three words, and the version to be exactly HTTP/1.1 or HTTP/1.0
• Accept optional whitespace before the ; of a chunk extension, as RFC 9112 §7.1.1 permits

... (truncated)

Commits

• 710614b Version bump to 1.14.1
• 327bb02 Merge commit from fork
• 81f50c2 Bug fix: Bound Accept-Encoding q-values to the RFC9110§12.4.2 grammar before ...
• 2431e06 Logo updates
• ecea805 Bump elixir-ci-actions to pinned-actions commit (#732)
• 31636b5 Trim trailing whitespace from HTTP/1 header values (RFC9110§5.5) (#731)
• 4d7203d Reject IPv6 authority ports without a colon (#730)
• b8971bf Close HTTP/1 connections after successful CONNECT responses (#729)
• de3fc8c Add files via upload (#728)
• 0ac00c3 Bump getplumber/plumber from 0.7.0 to 0.7.11 (#727)
• Additional commits viewable in compare view

Updates ecto_sqlite3 from 0.25.0 to 0.26.0

Changelog

Sourced from ecto_sqlite3's changelog.

v0.26.0

• changed: Bump minimum version of exqlite to ~> 0.40.
• changed: Raise on incorrect use of drop mode.
• added: Support rendering :modifiers in CREATE TABLE commands.
• added: Support check constraints via Ecto.Migration.constraint/3.
• changed: Reimplement querying prefix names.
• added: Raise on cross-database foreign keys.
• changed: Made quote_name/1 private.
• changed: quote_name no longer accepts names with double quote.

Commits

• d25d4aa feat: bump to v0.26.0
• aef454e chore: bump minimum exqlite version to ~0.40
• cc2a7c2 chore(ci): update checkout and cache
• a9b5129 Test query returns no result without prefix
• 8f117d3 Support modifiers and drop mode
• d0ad056 Stricter testing for raised error messages
• 3b1a832 Support table-level check constraints
• 57325b4 Fix incorrectly named BinaryUUIDTest that didn't get loaded
• ae81964 Remove deprecated parentheses after field access usage in tests
• d660df7 use :prefix to query attached databases (#183)
• See full diff in compare view

Updates plug_crypto from 2.2.0 to 2.2.1

Changelog

Sourced from plug_crypto's changelog.

v2.2.1 (2026-10-23)

• Avoid secret key base from being written to logs in case of bad args (CVE-2026-105963) (GHSA-ffw9-w85g-f2vh)

Commits

• 9b36a12 Release v2.2.1
• 9818874 Avoid secret key base from being written to logs in case of bad args
• 09955be Differentiate between secret and salt in docs (#53)
• See full diff in compare view

Updates req from 0.7.4 to 0.7.5

Release notes

Sourced from req's releases.

v0.7.5

• put_aws_sigv4: Fix SigV4 signing on retries.
• redirect: Change method to GET (except HEAD) on HTTP 303. Thanks to @​euriconicacio for reporting this.

Changelog

Sourced from req's changelog.

v0.7.5 (2026-10-06)

• [put_aws_sigv4]: Fix SigV4 signing on retries.
• [redirect]: Change method to GET (except HEAD) on HTTP 303.

Commits

• 2ce74f1 Release v0.7.5
• 10c7414 Fix connect timeout test
• 331c5d9 Fix SigV4 signing on retries
• bd18cb2 redirect: Change method to GET (except HEAD) on HTTP 303
• See full diff in compare view

Updates sbom from 0.11.0 to 0.12.0

Release notes

Sourced from sbom's releases.

v0.12.0

What's Changed

• Build burrito targets in parallel via matrix by @​maennchen in erlef/mix_sbom#156
• Keep the application version in the purl for Erlang apps by @​Hermanverschooten in erlef/mix_sbom#158
• Add vulnerabilities from OSV.dev by @​igorgbr in erlef/mix_sbom#160
• Accept optional applications in application/0 by @​maennchen in erlef/mix_sbom#169

Dependency Updates

• Update ghcr.io/oss-review-toolkit/ort Docker tag to v94.2.0 by @​renovate[bot] in erlef/mix_sbom#159
• Bump the github-actions group with 2 updates by @​dependabot[bot] in erlef/mix_sbom#161
• Update ghcr.io/oss-review-toolkit/ort Docker tag to v95 by @​renovate[bot] in erlef/mix_sbom#162
• Update ghcr.io/oss-review-toolkit/ort Docker tag to v96 by @​renovate[bot] in erlef/mix_sbom#163
• Bump the github-actions group with 4 updates by @​dependabot[bot] in erlef/mix_sbom#165
• Bump protobuf from 0.17.0 to 0.17.1 in the mix-dependencies group by @​dependabot[bot] in erlef/mix_sbom#164
• Allow hex_core 0.20 by @​maennchen in erlef/mix_sbom#168
• Update ghcr.io/oss-review-toolkit/ort Docker tag to v97 by @​renovate[bot] in erlef/mix_sbom#167

New Contributors

• @​igorgbr made their first contribution in erlef/mix_sbom#160

Full Changelog: erlef/mix_sbom@v0.11.0...v0.12.0

Commits

• 96bb84f Release v0.12.0
• a821425 Accept optional applications in application/0 (#169)
• 4639073 Allow hex_core 0.20 (#168)
• bbc248f Update ghcr.io/oss-review-toolkit/ort Docker tag to v97 (#167)
• ebbbefb Bump protobuf from 0.17.0 to 0.17.1 in the mix-dependencies group (#164)
• 22d0b50 Bump the github-actions group with 4 updates (#165)
• 92ad599 Add vulnerabilities from OSV.dev (#160)
• 06ac313 Update ghcr.io/oss-review-toolkit/ort Docker tag to v96 (#163)
• 38b9a28 Update ghcr.io/oss-review-toolkit/ort Docker tag to v95 (#162)
• 9904379 Bump the github-actions group with 2 updates (#161)
• Additional commits viewable in compare view

Updates sobelow from 0.16.0 to 0.18.1

Release notes

Sourced from sobelow's releases.

v0.18.1

What's Changed

• Fix crash on Module.concat with brackets by @​katafrakt in sobelow/sobelow#68
• Prepare v0.18.1 release by @​houllette in sobelow/sobelow#69

Full Changelog: sobelow/sobelow@v0.18.0...v0.18.1

v0.18.0

• Enhancements

  • Add the Crypto category with WeakHash and WeakCipher checks for literal algorithm choices, including Erlang's streaming MD5 initializer.
  • Add Config.TLSVerify to report disabled TLS certificate verification in scanned source and production configuration, including both Hackney insecure option forms. Server and unknown SSL roles receive low confidence. TLS skip fingerprints include the original call AST.
  • Add DOS.Consult for dynamic file selection in :file.consult/1 and :file.path_consult/2, which can create atoms from untrusted term files.
  • Misc.BinToTerm reports Erlang calls with explicit :safe options at medium confidence instead of high, changing --exit high behavior. It also reports Plug's non-executable decoder without proven :safe. Existing finding IDs, source locations, and skip fingerprints are preserved.
  • Add RCE.File for dynamic file selection in Erlang eval and script APIs, including search paths, pipes and captures.
  • The new file-selection and cryptography checks resolve explicit Erlang imports, including pipes, captures and import arity restrictions.
  • Add DOS.ModuleConcat for dynamic module-name atom creation through Module.concat/1,2, including aliases, imports, pipes and captures.
  • Extend DOS.BinToAtom to interpolated atom word sigils (~w(...)a). Existing atom-interpolation findings, IDs and fingerprints are preserved.
  • Add RCE.Compile for dynamic source, ASTs and file selection in Code.compile_string, compile_quoted, compile_file and require_file.
  • Add Crypto.WeakSignature for explicit MD5 and SHA-1 digest selections in Erlang crypto and public-key signature APIs.
  • Add Config.WeakTLS for explicit legacy SSL, TLS and DTLS protocol selections, sharing source discovery, skips and TLS option parsing with Config.TLSVerify without changing existing TLS finding fingerprints.

• Bug fixes

  • Retain imported sinks in pipes without parentheses and parameter labels inside constructed ASTs. Qualified Kernel atom-word sigils are detected. These patterns can produce new findings; existing locations and skip fingerprints are unchanged.
  • TLS checks resolve explicit SSL and Hackney imports within their scope, retaining low confidence for imported SSL server calls. Literal TLS options and weak versions in cons lists and concatenations are retained.

What's Changed

• Add new checks from Jump fork by @​katafrakt in sobelow/sobelow#65
• Add atom construction, compilation, signature, and TLS checks by @​houllette in sobelow/sobelow#66

... (truncated)

Changelog

Sourced from sobelow's changelog.

v0.18.1

• Bug fixes
  • Prevent bracket access on fields and anonymous calls from leaking AST tuples into finding labels and aborting scans, including interpolated input to module-name, atom, compilation and file-selection checks. Chained brackets retain their original input labels, including conn.params confidence. Existing finding source locations and skip fingerprints are unchanged.

v0.18.0

• Enhancements

  • Add the Crypto category with WeakHash and WeakCipher checks for literal algorithm choices, including Erlang's streaming MD5 initializer.
  • Add Config.TLSVerify to report disabled TLS certificate verification in scanned source and production configuration, including both Hackney insecure option forms. Server and unknown SSL roles receive low confidence. TLS skip fingerprints include the original call AST.
  • Add DOS.Consult for dynamic file selection in :file.consult/1 and :file.path_consult/2, which can create atoms from untrusted term files.
  • Misc.BinToTerm reports Erlang calls with explicit :safe options at medium confidence instead of high, changing --exit high behavior. It also reports Plug's non-executable decoder without proven :safe. Existing finding IDs, source locations, and skip fingerprints are preserved.
  • Add RCE.File for dynamic file selection in Erlang eval and script APIs, including search paths, pipes and captures.
  • The new file-selection and cryptography checks resolve explicit Erlang imports, including pipes, captures and import arity restrictions.
  • Add DOS.ModuleConcat for dynamic module-name atom creation through Module.concat/1,2, including aliases, imports, pipes and captures.
  • Extend DOS.BinToAtom to interpolated atom word sigils (~w(...)a). Existing atom-interpolation findings, IDs and fingerprints are preserved.
  • Add RCE.Compile for dynamic source, ASTs and file selection in Code.compile_string, compile_quoted, compile_file and require_file.
  • Add Crypto.WeakSignature for explicit MD5 and SHA-1 digest selections in Erlang crypto and public-key signature APIs.
  • Add Config.WeakTLS for explicit legacy SSL, TLS and DTLS protocol selections, sharing source discovery, skips and TLS option parsing with Config.TLSVerify without changing existing TLS finding fingerprints.

• Bug fixes

  • Retain imported sinks in pipes without parentheses and parameter labels inside constructed ASTs. Qualified Kernel atom-word sigils are detected. These patterns can produce new findings; existing locations and skip fingerprints are unchanged.
  • TLS checks resolve explicit SSL and Hackney imports within their scope, retaining low confidence for imported SSL server calls. Literal TLS options and weak versions in cons lists and concatenations are retained.

v0.17.0

... (truncated)

Commits

• 97796cc Prepare v0.18.1 release
• 1aab6b2 Fix bracket access labels across shared sink extraction
• cfe7137 Fix crash on Module.concat with brackets
• 225c794 Prepare v0.18.0 release
• 43d0cf8 Close adversarial gaps in security sink matching
• d167bc5 Normalize literal module names across supported Elixir releases
• 31496af Add Config.WeakTLS with shared TLS source and option traversal
• 7530d6a Add Crypto.WeakSignature for MD5 and SHA-1 signatures
• aa2b2a0 Add RCE.Compile for source compilation and file loading
• 45bbaf1 Detect interpolated atom word sigils without duplicating atom findings
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions