[dependabot]

Bumps the mix-minor-and-patch group with 6 updates:

Package	From	To
bandit	1.13.1	1.14.1
hammer	7.5.0	7.5.1
inertia	3.1.0	3.1.1
phoenix_html	4.3.0	4.4.0
sentry	14.0.0	14.0.1
swoosh	1.29.0	1.29.3

Updates bandit from 1.13.1 to 1.14.1

Changelog

Sourced from bandit's changelog.

1.14.1 (28 Oct 2026)

Changes

• Close an HTTP/1 connection after a 2xx response to CONNECT, as RFC 9110 §9.3.6 requires. Before, the connection stayed open and could serve a later request (#729, thanks @​neilberkman!)
• Reject an HTTP/2 request whose host header does not match :authority, or that has more than one host header, with a stream PROTOCOL_ERROR (RFC 9113 §8.3.1) (#725, thanks @​neilberkman!)
• Remove connection-specific header fields (connection, keep-alive, proxy-connection, transfer-encoding and upgrade) from HTTP/2 responses, as RFC 9113 §8.2.2 requires. Before, clients such as curl and Firefox reset the stream (#728, thanks @​mpettibone!)

Fixes

• Collect HTTP/2 request bodies into one binary, so that a body sent as many tiny DATA frames no longer uses many times its size in memory (GHSA-pxjf-g536-7r93, thanks @​neilberkman!)
• Read Accept-Encoding q-values with the RFC 9110 §12.4.2 grammar. Before, a q-value with a very long integer part caused a 500 on every request (#733, thanks @​mpettibone!)
• Remove trailing whitespace from HTTP/1 header values (RFC 9110 §5.5). Before, a Host header with a trailing space got a 400 (#731, thanks @​mpettibone!)
• Reject an IPv6 literal authority with no colon before the port (for example [::1]80) (RFC 3986 §3.2) (#730, thanks @​neilberkman!)
• Send RST_STREAM for an oversized HTTP/2 header block as a stream error, and keep the HPACK decoder state (RFC 9113 §5.4.2) (#726, thanks @​neilberkman!)

1.14.0 (26 Oct 2026)

Changes

• Advertise a default HTTP/2 max_concurrent_streams of 500 and a default max_header_list_size of 262144 bytes in the initial SETTINGS frame. Before, both were unlimited. The entries of a SETTINGS frame are now sorted
• Refill the HTTP/2 connection receive window to 16 MiB as data arrives. Refill a stream receive window to 1 MiB only after the stream reads data. Before, the server granted 2^31-1 bytes on the first DATA frame
• Join HTTP/2 DATA frames into larger messages when a stream is slow to read. As a result, read_body can return more than :length bytes, up to the stream receive window
• Reset an HTTP/2 stream with ENHANCE_YOUR_CALM when it has 100 unread messages, and close the connection with ENHANCE_YOUR_CALM when a client sends more than 100 non-ACK SETTINGS frames in 10 seconds
• Reset an HTTP/2 stream with STREAM_CLOSED when the client sends DATA or HEADERS after END_STREAM
• Send PROTOCOL_ERROR for DATA, WINDOW_UPDATE and RST_STREAM on an idle HTTP/2 stream, and report the last stream that the server started in the GOAWAY frame
• Reject an HTTP/1 absolute-form request target whose path :erlang.decode_packet/3 reads differently from RFC 3986. As a result, a target with an empty path followed by a query (for example http://host:80?a=b) now gets 400. Before, its query was silently discarded
• Require the HTTP/1 request line to have exactly three words, and the version to be exactly HTTP/1.1 or HTTP/1.0
• Accept optional whitespace before the ; of a chunk extension, as RFC 9112 §7.1.1 permits

... (truncated)

Commits

• 710614b Version bump to 1.14.1
• 327bb02 Merge commit from fork
• 81f50c2 Bug fix: Bound Accept-Encoding q-values to the RFC9110§12.4.2 grammar before ...
• 2431e06 Logo updates
• ecea805 Bump elixir-ci-actions to pinned-actions commit (#732)
• 31636b5 Trim trailing whitespace from HTTP/1 header values (RFC9110§5.5) (#731)
• 4d7203d Reject IPv6 authority ports without a colon (#730)
• b8971bf Close HTTP/1 connections after successful CONNECT responses (#729)
• de3fc8c Add files via upload (#728)
• 0ac00c3 Bump getplumber/plumber from 0.7.0 to 0.7.11 (#727)
• Additional commits viewable in compare view

Updates hammer from 7.5.0 to 7.5.1

Changelog

Sourced from hammer's changelog.

7.5.1 - 2026-10-26

• Fix SlidingWindow ETS backend counting denied hits. A denied hit stayed in the window, so callers that slept for retry_after and retried at staggered moments kept the window full and were denied forever. Denied hits are now removed from the window. Behaviour change: a client that keeps hitting after being denied no longer extends its own block; the ETS backend now matches the Redis backend here. (#210)
• Fix SlidingWindow ETS backend recording at most one hit per microsecond per key. Concurrent hits that landed in the same microsecond shared an ETS key, so the extra ones went unrecorded and could be allowed past the limit. Each hit now gets a unique entry. (#210)
• Fix SlidingWindow ETS backend raising Enum.EmptyError on the deny path when concurrent denied hits emptied the window; it now returns {:deny, 1}. (#210)

Commits

• 0e590be chore: Release 7.5.1 (#214)
• a1ba1b7 fix(ets): don't count denied hits in sliding window (#210)
• 6c82502 Update comment in sliding_window.ex (#208)
• 0860c14 docs: add sgrep code search guidance to AGENTS.md
• ea777ac docs: add project-specific AGENTS.md and thin CLAUDE.md wrapper
• See full diff in compare view

Updates inertia from 3.1.0 to 3.1.1

Release notes

Sourced from inertia's releases.

Version 3.1.1

Fixed

• Prefetch requests no longer turn a redirect to a URL with a #fragment into a 409 with X-Inertia-Redirect. The check read an X-Inertia-Purpose header that the client never sends; it now reads the Purpose: prefetch header the client sets on prefetch visits, matching the Laravel adapter. A prefetch now follows the redirect and caches the page it lands on.

Changelog

Sourced from inertia's changelog.

3.1.1 - 2026-10-28

Fixed

• Prefetch requests no longer turn a redirect to a URL with a #fragment into a 409 with X-Inertia-Redirect. The check read an X-Inertia-Purpose header that the client never sends; it now reads the Purpose: prefetch header the client sets on prefetch visits, matching the Laravel adapter. A prefetch now follows the redirect and caches the page it lands on.

Commits

• 79dbd39 Version 3.1.1
• 37140ad Read the Purpose header for the fragment redirect prefetch check
• bbd5aee Add an agent guide
• 7cd1d9c Update credo to 1.7.19
• 99437f0 Remove no-op CircleCI config
• a101df4 Update example npm dependencies to fix Dependabot alerts
• 5adc474 Add release skill and update RELEASING.md
• See full diff in compare view

Updates phoenix_html from 4.3.0 to 4.4.0

Changelog

Sourced from phoenix_html's changelog.

4.4.0 (2026-10-30)

• Security

  • Validate attribute names to prevent attribute injection for user-supplied attributes (CVE-2026-117645)

• Enhancements

  • Add Phoenix.HTML.json_escape/1 to escape encoded JSON for safe insertion into an HTML script tag

Commits

• 15ba2aa Release v4.4.0
• d9e4e6b validate attribute keys
• 7cbed82 Transition json_escape/5 to 4-arity after escaping (#475)
• 6548938 Add json_escape (#474)
• 677e572 Improve docs
• 309d62e Fix "idiosyncracies" -> "idiosyncrasies" typo (#473)
• b21a2d0 Escape $ in javascript_escape but reinforce template literals are NOT supported
• c1b46f0 Raise on invalid characters in attributes_escape
• See full diff in compare view

Updates sentry from 14.0.0 to 14.0.1

Release notes

Sourced from sentry's releases.

14.0.1

Bug Fixes 🐛

• Correctly classify HTTP statuses in spans by @​whatyouhide in #1245
• Only create new check in IDs on "start" by @​whatyouhide in #1252
• Stop dropping transaction root status by @​whatyouhide in #1244
• Don't discard client reports on every single request error by @​whatyouhide in #1246
• Correct RateLimiter.start_under_sentry_supervisor/2 spec by @​lukaszsamson in #1248
• (docs) Point to the correct migration guide URLs by @​solnic in #1241
• (test) Skip unrelated envelopes in typed collectors by @​whatyouhide in #1253

Other

• Fix compilation warning on Elixir 1.20+ by @​whatyouhide in #1243

Changelog

Sourced from sentry's changelog.

14.0.1

Bug Fixes 🐛

• Correctly classify HTTP statuses in spans by @​whatyouhide in #1245
• Only create new check in IDs on "start" by @​whatyouhide in #1252
• Stop dropping transaction root status by @​whatyouhide in #1244
• Don't discard client reports on every single request error by @​whatyouhide in #1246
• Correct RateLimiter.start_under_sentry_supervisor/2 spec by @​lukaszsamson in #1248
• (docs) Point to the correct migration guide URLs by @​solnic in #1241
• (test) Skip unrelated envelopes in typed collectors by @​whatyouhide in #1253

Other

• Fix compilation warning on Elixir 1.20+ by @​whatyouhide in #1243

Commits

• a9540fd chore(docs): update CHANGELOG for 14.0.1
• 1bcceb2 chore(ci): bump setup-beam (#1250)
• 9a948df release: 14.0.1
• e0138ff fix(tests): 302 is now ok (#1258)
• 12c56df fix: correctly classify HTTP statuses in spans (#1245)
• 74b7620 fix: only create new check in IDs on "start" (#1252)
• 8f0a3e3 fix(test): skip unrelated envelopes in typed collectors (#1253)
• 7b84eac fix: stop dropping transaction root status (#1244)
• 835ac1a fix: don't discard client reports on every single request error (#1246)
• b7f95c3 fix: correct RateLimiter.start_under_sentry_supervisor/2 spec (#1248)
• Additional commits viewable in compare view

Updates swoosh from 1.29.0 to 1.29.3

Release notes

Sourced from swoosh's releases.

v1.29.3 🚀

🧰 Maintenance

• Replace release comment action with a deduping gh script @​princemaple (#1225)

Full Changelog: swoosh/swoosh@v1.29.1...v1.29.3

v1.29.1 🚀

🐛 Bug Fixes

• Fix Mailgun tags failing when the email has attachments @​jadhavgaurav (#1221)
• Customer.io adapter: send attachments as a filename-keyed object @​ashabhasa (#1214)

🧰 Maintenance

• Build sendmail command line as list @​adamwight (#1216)
• Test Req with plug and not adapter @​adamwight (#1217)

New Contributors

• @​ashabhasa made their first contribution in swoosh/swoosh#1214
• @​adamwight made their first contribution in swoosh/swoosh#1217
• @​jadhavgaurav made their first contribution in swoosh/swoosh#1221

Full Changelog: swoosh/swoosh@v1.29.0...v1.29.1

Changelog

Sourced from swoosh's changelog.

1.29.3

🧰 Maintenance

• Replace the release comment action with a script that comments once per pull request

1.29.1

This release was published to Hex as 1.29.2 by mistake, so there is no 1.29.1 on Hex. The GitHub release and tag are v1.29.1.

🧰 Maintenance

• Deprecate configuring Sendmail with string cmd_args. Strings are split honoring quotes, but pipes, redirects and variables are no longer interpreted.
• Run the Sendmail binary directly instead of through a shell. A relative cmd_path is still looked up in PATH but is deprecated, and a missing binary raises instead of silently returning {:ok, %{}}. Swoosh.Adapters.Sendmail.cmd/2 and shell_escape/1 are removed, and cmd_args now takes the email.

🐛 Bug Fixes

• Send Customer.io attachments as a filename-keyed object @​ashabhasa (#1214)
• Fix Mailgun tags failing when the email has attachments @​jadhavgaurav (#1221)

Commits

• 8018382 Prepare 1.29.3 release
• 1d7ea41 Grant contents: write to release comment for generate-notes
• 1b9b882 Replace release comment action with a deduping gh script (#1225)
• 4343cde Update changelog for version 1.29.1
• 4e11670 Add Mailgun tags fix (#1221) to 1.29.1 changelog
• 9264043 Merge pull request #1221 from jadhavgaurav/fix/mailgun-tags-with-attachments-...
• d2463a8 Document that a nil Mailgun multipart value emits no part
• e164107 Fix Mailgun tags failing when the email has attachments
• 760c130 Merge pull request #1220 from swoosh/copilot/prepare-patch-release
• 973a771 Prepare 1.29.2 patch release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions