[dependabot]

Bumps the all-dependencies group with 8 updates:

Package	From	To
ash	3.37.1	3.37.2
bandit	1.13.1	1.14.1
cinder	0.17.0	0.18.0
esbuild	0.10.0	0.10.1
ex_check	0.17.0	0.17.1
phoenix_html	4.3.0	4.4.0
sobelow	0.15.0	0.18.0
tailwind	0.5.1	0.5.2

Updates ash from 3.37.1 to 3.37.2

Release notes

Sourced from ash's releases.

v3.37.2

Bug Fixes:

• don't crash a bulk create when an upsert it runs singly is skipped by @​zachdaniel

• [security] scope upserts to the tenant under attribute multitenancy (CVE-2026-96581, GHSA-vw7c-67pf-gh96) by @​zachdaniel

Changelog

Sourced from ash's changelog.

v3.37.2 (2026-10-26)

Bug Fixes:

• don't crash a bulk create when an upsert it runs singly is skipped by @​zachdaniel

• [security] scope upserts to the tenant under attribute multitenancy (CVE-2026-96581, GHSA-vw7c-67pf-gh96) by @​zachdaniel

Commits

• a8c62e2 chore: release version v3.37.2
• b6bf308 fix: don't crash a bulk create when an upsert it runs singly is skipped
• c9f0cdb fix: scope upserts to the tenant under attribute multitenancy
• ca0c44a docs: reference the CVEs fixed in the last release
• See full diff in compare view

Updates bandit from 1.13.1 to 1.14.1

Changelog

Sourced from bandit's changelog.

1.14.1 (28 Oct 2026)

Changes

• Close an HTTP/1 connection after a 2xx response to CONNECT, as RFC 9110 §9.3.6 requires. Before, the connection stayed open and could serve a later request (#729, thanks @​neilberkman!)
• Reject an HTTP/2 request whose host header does not match :authority, or that has more than one host header, with a stream PROTOCOL_ERROR (RFC 9113 §8.3.1) (#725, thanks @​neilberkman!)
• Remove connection-specific header fields (connection, keep-alive, proxy-connection, transfer-encoding and upgrade) from HTTP/2 responses, as RFC 9113 §8.2.2 requires. Before, clients such as curl and Firefox reset the stream (#728, thanks @​mpettibone!)

Fixes

• Collect HTTP/2 request bodies into one binary, so that a body sent as many tiny DATA frames no longer uses many times its size in memory (GHSA-pxjf-g536-7r93, thanks @​neilberkman!)
• Read Accept-Encoding q-values with the RFC 9110 §12.4.2 grammar. Before, a q-value with a very long integer part caused a 500 on every request (#733, thanks @​mpettibone!)
• Remove trailing whitespace from HTTP/1 header values (RFC 9110 §5.5). Before, a Host header with a trailing space got a 400 (#731, thanks @​mpettibone!)
• Reject an IPv6 literal authority with no colon before the port (for example [::1]80) (RFC 3986 §3.2) (#730, thanks @​neilberkman!)
• Send RST_STREAM for an oversized HTTP/2 header block as a stream error, and keep the HPACK decoder state (RFC 9113 §5.4.2) (#726, thanks @​neilberkman!)

1.14.0 (26 Oct 2026)

Changes

• Advertise a default HTTP/2 max_concurrent_streams of 500 and a default max_header_list_size of 262144 bytes in the initial SETTINGS frame. Before, both were unlimited. The entries of a SETTINGS frame are now sorted
• Refill the HTTP/2 connection receive window to 16 MiB as data arrives. Refill a stream receive window to 1 MiB only after the stream reads data. Before, the server granted 2^31-1 bytes on the first DATA frame
• Join HTTP/2 DATA frames into larger messages when a stream is slow to read. As a result, read_body can return more than :length bytes, up to the stream receive window
• Reset an HTTP/2 stream with ENHANCE_YOUR_CALM when it has 100 unread messages, and close the connection with ENHANCE_YOUR_CALM when a client sends more than 100 non-ACK SETTINGS frames in 10 seconds
• Reset an HTTP/2 stream with STREAM_CLOSED when the client sends DATA or HEADERS after END_STREAM
• Send PROTOCOL_ERROR for DATA, WINDOW_UPDATE and RST_STREAM on an idle HTTP/2 stream, and report the last stream that the server started in the GOAWAY frame
• Reject an HTTP/1 absolute-form request target whose path :erlang.decode_packet/3 reads differently from RFC 3986. As a result, a target with an empty path followed by a query (for example http://host:80?a=b) now gets 400. Before, its query was silently discarded
• Require the HTTP/1 request line to have exactly three words, and the version to be exactly HTTP/1.1 or HTTP/1.0
• Accept optional whitespace before the ; of a chunk extension, as RFC 9112 §7.1.1 permits

... (truncated)

Commits

• 710614b Version bump to 1.14.1
• 327bb02 Merge commit from fork
• 81f50c2 Bug fix: Bound Accept-Encoding q-values to the RFC9110§12.4.2 grammar before ...
• 2431e06 Logo updates
• ecea805 Bump elixir-ci-actions to pinned-actions commit (#732)
• 31636b5 Trim trailing whitespace from HTTP/1 header values (RFC9110§5.5) (#731)
• 4d7203d Reject IPv6 authority ports without a colon (#730)
• b8971bf Close HTTP/1 connections after successful CONNECT responses (#729)
• de3fc8c Add files via upload (#728)
• 0ac00c3 Bump getplumber/plumber from 0.7.0 to 0.7.11 (#727)
• Additional commits viewable in compare view

Updates cinder from 0.17.0 to 0.18.0

Changelog

Sourced from cinder's changelog.

v0.18.0 (2026-10-28)

Breaking changes

• Cinder now requires phoenix_live_view ~> 1.1, and ships a colocated hook that your app.js must register. Run mix cinder.upgrade 0.17.0 0.18.0, or see the upgrading guide.
• Cinder now requires Ash 3.24.5 or later, and ash_sql 0.6.3 or later in apps that use it.
• A filter that fails to build now shows the collection's error state, instead of quietly showing unfiltered results. If a collection shows its error state after upgrading, check your logs for the filter that failed.

Features

• Added initial_load={:sync}, which puts the first page of data in the server-rendered HTML. Thanks @​Alt-iOS! (#203)
• on_query_change payloads now carry a count key with the total matching records, so parents no longer need their own Ash.count!. Thanks @​mbaertschi! (#208)
• refresh_table/3 and refresh_tables/3 accept silent: true, which keeps the current rows on screen without a loading indicator while the refresh runs. Thanks @​Alt-iOS! (#226)
• Added remove_item/3 and remove_items/3, which remove rows from a collection without re-querying, dropping them from the selection and the footer count. Thanks @​Alt-iOS! (#229)
• pagination accepts a keyword list, with a count option: true (default), :async to count in the background, or false to skip the total count. Thanks @​Alt-iOS! (#241)
• use Cinder.UrlSync is now all a LiveView needs for URL sync, without a handle_params/3 calling Cinder.UrlSync.handle_params/3.
• Columns load what their fields need (relationships in the path, calculations and aggregates), so they no longer need query_opts={[load: ...]}. (#122)
• A column's sort option accepts then, tiebreaker fields sorted after all of the user's sorts, eg. sort={[then: ["inserted_at"]]}. Thanks @​DGollings! (#251)
• Collections emit [:cinder, :query] and [:cinder, :count] telemetry spans, and Ash.Tracer spans that Ash's own nest inside, saying which collection loaded and with what filters. See the advanced guide.

Bugfixes

• Multi-select filters work on list aggregates and array calculations, instead of crashing.
• Multi-select filters on an array field through a relationship (like albums.tags) match records whose related records hold the selected values.
• Columns on a calculation that needs arguments are no longer offered as sortable or filterable, which failed when used.
• A collection's data load no longer copies the parent LiveView's assigns into its task once per column, which could reach gigabytes on a busy page. Thanks @​DGollings! (#250)
• Text filters with operator: :starts_with or :ends_with now match only the start or end of the value, instead of anywhere in it.
• Global search no longer repeats the query's existing filters inside every search branch, and a searchable column with an invalid field no longer stops search from narrowing a filtered query. Thanks @​Alt-iOS! (#244)
• Typing in an autocomplete filter's search box no longer reloads the collection on every keystroke. Thanks @​Alt-iOS! (#246)
• Clearing a date or number filter now also clears a partially typed value, and the filter's × and "Clear all" show while one is typed.
• Radio group and autocomplete filters on enum fields now list the enum's values when no options are given, like select filters already did.
• Multi-select filters on an array of an enum (or of one_of values) now list its values when no options are given.
• Number range filters' min, max and step options now apply to both inputs, where they were ignored.
• Removed date filters' format option, which did nothing: browser date inputs always show dates in the user's locale.
• Autocomplete filters in a <:filter> slot now use their max_results, which was ignored.
• A collection with on_state_change but no url_state now applies filter and sort changes, which waited for a URL change that never came.
• A custom filter configured under a built-in filter's name logs its "Cannot override built-in filter type" warning when first used, so it no longer depends on Cinder.setup/0.
• Radio group filters with non-string option values (like enum atoms) now show the chosen option as selected, instead of losing it on the first click.
• Keyset pagination's "Next page" now works in apps that don't set config :ash, default_page_type: :keyset, where it previously reloaded the first page.
• Keyset pagination's "Next" button reads "Weiter", "Volgende" and "Nästa" in German, Dutch and Swedish, instead of "Next page".
• Sort keys sent by the client are now ignored unless they're a declared sortable column, so they can no longer create atoms or sort by fields that weren't defined as sortable.
• Self-closing <:col field="..." /> columns now render their field's value in table layouts, instead of crashing.
• Page numbers from the URL are capped at 1,000,000, and multi-select values from the URL or a form are trimmed to the filter's options (or to 100 when it has none), so they can't make a query do unbounded work.
• Bulk actions only act on selected records that are still in the collection's query, and the selection is cleared when the query changes.
• A bulk action that partly fails now fires on_error instead of on_success.
• Invalid bulk action events are ignored instead of crashing the collection.
• Filter values that can't be used, like an invalid date in the URL, are ignored instead of breaking the collection.

Deprecations

... (truncated)

Commits

• 0fca767 Tag and release v0.18.0 🎉
• ea32d2e List filters failing closed with the breaking changes, as it can turn a quiet...
• 28c9b8c Let the test suite pass when run twice in one VM: unload modules compiled fro...
• e49de31 Apply filter and sort changes in a collection with on_state_change but no U...
• e232837 Filter on a real field in the filter slot options test, which logged a warning
• b2f4dbd Bring the guides and API docs up to date with 0.18, in plainer English
• 09b8ab0 Bring the upgrade guide up to date: add 0.14 and 0.17, the rest of 0.18, and ...
• a96c37d Pass max_results from a \<:filter> slot to its autocomplete filter
• 4619288 Remove date filters' format option, which browser date inputs can't use
• aed7b3b Apply number range filters' min, max and step to both inputs
• Additional commits viewable in compare view

Updates esbuild from 0.10.0 to 0.10.1

Changelog

Sourced from esbuild's changelog.

v0.10.1 (2026-10-19)

• Don't try to compute the target if a :path is configured

Commits

• 06a1ec0 Release v0.10.1
• b44264e Merge pull request #84 from phoenixframework/sd-prefer-path
• 13d73c6 Do not detect the target when :path is configured
• See full diff in compare view

Updates ex_check from 0.17.0 to 0.17.1

Updates phoenix_html from 4.3.0 to 4.4.0

Changelog

Sourced from phoenix_html's changelog.

4.4.0 (2026-10-30)

• Security

  • Validate attribute names to prevent attribute injection for user-supplied attributes (CVE-2026-117645)

• Enhancements

  • Add Phoenix.HTML.json_escape/1 to escape encoded JSON for safe insertion into an HTML script tag

Commits

• 15ba2aa Release v4.4.0
• d9e4e6b validate attribute keys
• 7cbed82 Transition json_escape/5 to 4-arity after escaping (#475)
• 6548938 Add json_escape (#474)
• 677e572 Improve docs
• 309d62e Fix "idiosyncracies" -> "idiosyncrasies" typo (#473)
• b21a2d0 Escape $ in javascript_escape but reinforce template literals are NOT supported
• c1b46f0 Raise on invalid characters in attributes_escape
• See full diff in compare view

Updates sobelow from 0.15.0 to 0.18.0

Release notes

Sourced from sobelow's releases.

v0.18.0

• Enhancements

  • Add the Crypto category with WeakHash and WeakCipher checks for literal algorithm choices, including Erlang's streaming MD5 initializer.
  • Add Config.TLSVerify to report disabled TLS certificate verification in scanned source and production configuration, including both Hackney insecure option forms. Server and unknown SSL roles receive low confidence. TLS skip fingerprints include the original call AST.
  • Add DOS.Consult for dynamic file selection in :file.consult/1 and :file.path_consult/2, which can create atoms from untrusted term files.
  • Misc.BinToTerm reports Erlang calls with explicit :safe options at medium confidence instead of high, changing --exit high behavior. It also reports Plug's non-executable decoder without proven :safe. Existing finding IDs, source locations, and skip fingerprints are preserved.
  • Add RCE.File for dynamic file selection in Erlang eval and script APIs, including search paths, pipes and captures.
  • The new file-selection and cryptography checks resolve explicit Erlang imports, including pipes, captures and import arity restrictions.
  • Add DOS.ModuleConcat for dynamic module-name atom creation through Module.concat/1,2, including aliases, imports, pipes and captures.
  • Extend DOS.BinToAtom to interpolated atom word sigils (~w(...)a). Existing atom-interpolation findings, IDs and fingerprints are preserved.
  • Add RCE.Compile for dynamic source, ASTs and file selection in Code.compile_string, compile_quoted, compile_file and require_file.
  • Add Crypto.WeakSignature for explicit MD5 and SHA-1 digest selections in Erlang crypto and public-key signature APIs.
  • Add Config.WeakTLS for explicit legacy SSL, TLS and DTLS protocol selections, sharing source discovery, skips and TLS option parsing with Config.TLSVerify without changing existing TLS finding fingerprints.

• Bug fixes

  • Retain imported sinks in pipes without parentheses and parameter labels inside constructed ASTs. Qualified Kernel atom-word sigils are detected. These patterns can produce new findings; existing locations and skip fingerprints are unchanged.
  • TLS checks resolve explicit SSL and Hackney imports within their scope, retaining low confidence for imported SSL server calls. Literal TLS options and weak versions in cons lists and concatenations are retained.

What's Changed

• Add new checks from Jump fork by @​katafrakt in sobelow/sobelow#65
• Add atom construction, compilation, signature, and TLS checks by @​houllette in sobelow/sobelow#66
• Prepare v0.18.0 release by @​houllette in sobelow/sobelow#67

Full Changelog: sobelow/sobelow@v0.17.0...v0.18.0

v0.17.0

• Enhancements
  • DOS.ListToAtom now also reports :erlang.list_to_atom/1, including

... (truncated)

Changelog

Sourced from sobelow's changelog.

v0.18.0

• Enhancements

  • Add the Crypto category with WeakHash and WeakCipher checks for literal algorithm choices, including Erlang's streaming MD5 initializer.
  • Add Config.TLSVerify to report disabled TLS certificate verification in scanned source and production configuration, including both Hackney insecure option forms. Server and unknown SSL roles receive low confidence. TLS skip fingerprints include the original call AST.
  • Add DOS.Consult for dynamic file selection in :file.consult/1 and :file.path_consult/2, which can create atoms from untrusted term files.
  • Misc.BinToTerm reports Erlang calls with explicit :safe options at medium confidence instead of high, changing --exit high behavior. It also reports Plug's non-executable decoder without proven :safe. Existing finding IDs, source locations, and skip fingerprints are preserved.
  • Add RCE.File for dynamic file selection in Erlang eval and script APIs, including search paths, pipes and captures.
  • The new file-selection and cryptography checks resolve explicit Erlang imports, including pipes, captures and import arity restrictions.
  • Add DOS.ModuleConcat for dynamic module-name atom creation through Module.concat/1,2, including aliases, imports, pipes and captures.
  • Extend DOS.BinToAtom to interpolated atom word sigils (~w(...)a). Existing atom-interpolation findings, IDs and fingerprints are preserved.
  • Add RCE.Compile for dynamic source, ASTs and file selection in Code.compile_string, compile_quoted, compile_file and require_file.
  • Add Crypto.WeakSignature for explicit MD5 and SHA-1 digest selections in Erlang crypto and public-key signature APIs.
  • Add Config.WeakTLS for explicit legacy SSL, TLS and DTLS protocol selections, sharing source discovery, skips and TLS option parsing with Config.TLSVerify without changing existing TLS finding fingerprints.

• Bug fixes

  • Retain imported sinks in pipes without parentheses and parameter labels inside constructed ASTs. Qualified Kernel atom-word sigils are detected. These patterns can produce new findings; existing locations and skip fingerprints are unchanged.
  • TLS checks resolve explicit SSL and Hackney imports within their scope, retaining low confidence for imported SSL server calls. Literal TLS options and weak versions in cons lists and concatenations are retained.

v0.17.0

• Enhancements
  • DOS.ListToAtom now also reports :erlang.list_to_atom/1, including piped calls, matching how DOS.BinToAtom covers :erlang.binary_to_atom.
  • Add --only to run a chosen set of checks or categories, e.g. mix sobelow --only XSS.Raw,SQL. It takes the same names as --ignore, which still applies on top. Unknown names fail the run instead of scanning nothing. .sobelow-conf accepts only: and --save-config records it.

... (truncated)

Commits

• 225c794 Prepare v0.18.0 release
• 43d0cf8 Close adversarial gaps in security sink matching
• d167bc5 Normalize literal module names across supported Elixir releases
• 31496af Add Config.WeakTLS with shared TLS source and option traversal
• 7530d6a Add Crypto.WeakSignature for MD5 and SHA-1 signatures
• aa2b2a0 Add RCE.Compile for source compilation and file loading
• 45bbaf1 Detect interpolated atom word sigils without duplicating atom findings
• fa9b3d6 Add DOS.ModuleConcat for dynamic module-name atoms
• c745e4d Detect streaming Erlang MD5 and preserve zero-arity captures
• 448ca14 Harden TLS option detection, confidence, and skip identity
• Additional commits viewable in compare view

Updates tailwind from 0.5.1 to 0.5.2

Changelog

Sourced from tailwind's changelog.

v0.5.2 (2026-10-24)

• Allow larger response headers when downloading Tailwind (fixes {:header_too_long, {:max, 10240}} on OTP 27+)
• Fix typo in error message

Commits

• f0cca34 Release v0.5.2
• 900bf1d Merge pull request #142 from georgeguimaraes/fix-max-header-size
• c8809ca Allow larger response headers when downloading tailwind
• e796e8b Fix "overide" -> "override" typo in error message (#141)
• 1063868 update changelog
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions