Skip to content

build(deps): bump the mix-minor group with 7 updates - #1703

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/hex/mix-minor-a933d17c43
Open

build(deps): bump the mix-minor group with 7 updates#1703
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/hex/mix-minor-a933d17c43

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the mix-minor group with 7 updates:

Package From To
castore 1.0.20 1.0.21
guardian 2.4.0 2.5.0
phoenix 1.8.9 1.8.12
phoenix_live_reload 1.6.2 1.7.0
phoenix_live_view 1.2.7 1.2.10
phoenix_pubsub 2.2.0 2.3.0
sobelow 0.14.1 0.15.0

Updates castore from 1.0.20 to 1.0.21

Commits

Updates guardian from 2.4.0 to 2.5.0

Release notes

Sourced from guardian's releases.

v2.5.0

What's Changed

New Contributors

Full Changelog: ueberauth/guardian@v2.4.1...v2.5.0

v2.4.1

What's Changed

New Contributors

Full Changelog: ueberauth/guardian@v2.4.0...v2.4.1

Changelog

Sourced from guardian's changelog.

v2.5.0

Added

  • The verify plugs accept a one argument function for :secret, called with the connection to select a verifying secret per request. This covers multitenant setups where each tenant has its own key (#690).

    plug Guardian.Plug.VerifyHeader, secret: &MyApp.Secrets.for_conn/1

    Supported by Guardian.Plug.VerifyHeader, Guardian.Plug.VerifySession and Guardian.Plug.VerifyCookie, and exposed as Guardian.Plug.resolve_secret/2 for custom plugs. A :secret function of any other arity raises an ArgumentError instead of reaching the token module.

Changed

  • Behaviour change. Guardian.Token.Jwt.Verify rejects exp, nbf and auth_time claims that are not numbers, and Guardian.Token.Verify.time_within_drift?/2 returns false instead of true for a non-numeric time. Previously a token carrying a string or boolean in a time claim passed the drift check and was accepted as valid (#745).

  • Behaviour change. Guardian.Token.Jwt no longer falls back to the implementation module's :secret_key when an explicitly provided :secret is nil, or when a {module, function, args} secret resolves to nil. Both now fail with {:error, :secret_not_found}. Previously a runtime secret lookup that returned nil would silently sign or verify with the application wide secret, which defeats tenant isolation when third party issued tokens and application issued tokens share an implementation module. Omitting :secret entirely still uses :secret_key as before.

  • Guardian.Token.Jwt.decode_token/3 propagates {:error, :secret_not_found} instead of reporting it as {:error, :invalid_token}, so a missing runtime secret is distinguishable from a bad signature. Error handlers matching on {:invalid_token, :invalid_token} for this case should also match {:invalid_token, :secret_not_found}.

Documentation

  • Document that the verify plugs forward unrecognized options to Guardian.decode_and_verify/4, including Guardian.Token.Jwt's :secret, and add a "Runtime secrets" guide covering per-tenant verifying secrets.

v2.4.1

Security

... (truncated)

Commits
  • a9c9838 chore: release v2.5.0 (#749)
  • b1a7c81 feat(plug): select the verifying secret from the connection (#748)
  • 4073c73 fix(test): stop asserting atom safety against a global VM counter (#747)
  • 3e35f41 fix(ci): scope the build cache to the toolchain that produced it (#746)
  • 39fc160 feat: reject non-numeric JWT time claims (#745)
  • 8ca4373 chore: fix changelog
  • e6017b4 chore: fix mix docs
  • 53ab386 chore: bump version to 2.4.1
  • 2bd7a8c Merge commit from fork
  • 8d4efbf Merge commit from fork
  • Additional commits viewable in compare view

Updates phoenix from 1.8.9 to 1.8.12

Release notes

Sourced from phoenix's releases.

v1.8.12

Bug fixes

  • [phx.gen.auth] Fix return_to session key not being cleared after logging in (#6798)
  • [Channels] Fix channel messages being invalidly dropped when receiving messages without a join_ref (introduced in 1.8.3) (#6800)

v1.8.11

Bug fixes

  • Fix Phoenix crashing on boot if Mix is available, but not started (#6789)

v1.8.10

Bug fixes

  • [Phoenix.CodeReloader] Fix "must restart your server" messages from code reloader when compile.lock mtime changes without a content change (#6753)
  • [Phoenix.Endpoint] add missing websocket options (#6758)
  • [phoenix.js] Close and retry the longpoll transport when a batch POST times out (#6769)
  • [phoenix.js] Release the stale reply binding of a buffered push (#6788)

Enhancements

  • [phx.gen.release] Use Bob API to find Docker images in phx.gen.release --docker
  • [Channels] Allow LongPoll transport token to be sent in header (this will change in 1.9)
  • [Phoenix.Router] Support plugs with options in pipe_throught (#6755)
  • [Phoenix.Token] document encode options (see the change in plug_crypto)
  • [phoenix.js] Ensure transport errors are identifiable (#6763)
Changelog

Sourced from phoenix's changelog.

v1.8.12 (2026-08-20)

Bug fixes

  • [phx.gen.auth] Fix return_to session key not being cleared after logging in (#6798)
  • [Channels] Fix channel messages being invalidly dropped when receiving messages without a join_ref (introduced in 1.8.3) (#6800)

v1.8.11 (2026-08-12)

Bug fixes

  • Fix Phoenix crashing on boot if Mix is available, but not started (#6789)

v1.8.10 (2026-08-10)

Bug fixes

  • [Phoenix.CodeReloader] Fix "must restart your server" messages from code reloader when compile.lock mtime changes without a content change (#6753)
  • [Phoenix.Endpoint] add missing websocket options (#6758)
  • [phoenix.js] Close and retry the longpoll transport when a batch POST times out (#6769)
  • [phoenix.js] Release the stale reply binding of a buffered push (#6788)

Enhancements

  • [phx.gen.release] Use Bob API to find Docker images in phx.gen.release --docker
  • [Channels] Allow LongPoll transport token to be sent in header (this will change in 1.9)
  • [Phoenix.Router] Support plugs with options in pipe_throught (#6755)
  • [Phoenix.Token] document encode options (see the change in plug_crypto)
  • [phoenix.js] Ensure transport errors are identifiable (#6763)
Commits

Updates phoenix_live_reload from 1.6.2 to 1.7.0

Changelog

Sourced from phoenix_live_reload's changelog.

1.7.0 (2026-07-29)

  • Enhancements
    • Add JavaScript helper function to capture keyboard shortcuts to open HEEx components
    • Forward log events to window for custom behaviour
Commits

Updates phoenix_live_view from 1.2.7 to 1.2.10

Release notes

Sourced from phoenix_live_view's releases.

v1.2.10

Bug fixes

  • Preserve onReply exceptions in hook pushEvent / pushEventTo (#4381)
  • Handle writer errors like other upload entry errors (#4370)
  • Cancel scheduled submit when auto upload is invalid (#3391)
  • Fix max_entries not working properly with auto uploads (#2835)
  • Fix testing file uploads with multiple entries (#3480)
  • Remove native input required attribute when LiveView tracks uploads (#4377)
  • Accept new drops afrer too_many_files with max_entries 1 (#3368)
  • Fix runtime hook added node tracking (#4387)
  • Preserve zero-duration JS transitions (#4385)
  • Cancel submit in EntryUploader.error (#4382)
  • Cancel infinite scroll throttle timers on destroy (#4384)
  • Clear focus stack entries on view teardown (#4386)
  • Fix join completion for empty recovery markup (#4390)
  • Fix missing return after child join failure (#4391)
  • Stop page loading when pushes fail (#4392)
  • Ensure external metadata failures are reported consistently (#4397)

Enhancements

  • Mark morphdom as dev dependency, as it is already included in the bundle
  • Allow dynamically updating phx-hook attribute (#4153)
  • Allow external uploads to be notified on cancel (#4395)
  • Pass toEl to hook beforeUpdate (#3616)
  • Improve error message when attributes have been defined after an embedded template (#4396)
  • Add Phoenix.LiveView.navigation_type/2 (#4393)
  • Cancel external uploads when navigating away (#4398)
  • Allow to opt out of phx-remove cascade on navigation (#4394)
  • Make phx-drop-target-active more reliable (#4399)

v1.2.9

Security fixes

  • CVE-2026-64941: Fix open redirect in redirect/2 via ASCII tab, LF and CR

Bug fixes

  • Fix live components being wrongly destroyed in some rare cases (#4350)
  • Ensure parent navigation succeeds with a blocked child (#4359)

Enhancements

  • Add internal debug tooling to customize clientside rendering (#4364)

v1.2.8

... (truncated)

Changelog

Sourced from phoenix_live_view's changelog.

v1.2.10 (2026-08-20)

Bug fixes

  • Preserve onReply exceptions in hook pushEvent / pushEventTo (#4381)
  • Handle writer errors like other upload entry errors (#4370)
  • Cancel scheduled submit when auto upload is invalid (#3391)
  • Fix max_entries not working properly with auto uploads (#2835)
  • Fix testing file uploads with multiple entries (#3480)
  • Remove native input required attribute when LiveView tracks uploads (#4377)
  • Accept new drops afrer too_many_files with max_entries 1 (#3368)
  • Fix runtime hook added node tracking (#4387)
  • Preserve zero-duration JS transitions (#4385)
  • Cancel submit in EntryUploader.error (#4382)
  • Cancel infinite scroll throttle timers on destroy (#4384)
  • Clear focus stack entries on view teardown (#4386)
  • Fix join completion for empty recovery markup (#4390)
  • Fix missing return after child join failure (#4391)
  • Stop page loading when pushes fail (#4392)
  • Ensure external metadata failures are reported consistently (#4397)

Enhancements

  • Mark morphdom as dev dependency, as it is already included in the bundle
  • Allow dynamically updating phx-hook attribute (#4153)
  • Allow external uploads to be notified on cancel (#4395)
  • Pass toEl to hook beforeUpdate (#3616)
  • Improve error message when attributes have been defined after an embedded template (#4396)
  • Add Phoenix.LiveView.navigation_type/2 (#4393)
  • Cancel external uploads when navigating away (#4398)
  • Allow to opt out of phx-remove cascade on navigation (#4394)
  • Make phx-drop-target-active more reliable (#4399)

v1.2.9 (2026-08-10)

Security fixes

  • CVE-2026-64941: Fix open redirect in redirect/2 via ASCII tab, LF and CR

Bug fixes

  • Fix live components being wrongly destroyed in some rare cases (#4350)
  • Ensure parent navigation succeeds with a blocked child (#4359)

Enhancements

  • Add internal debug tooling to customize clientside rendering (#4364)

v1.2.8 (2026-07-27)

... (truncated)

Commits

Updates phoenix_pubsub from 2.2.0 to 2.3.0

Changelog

Sourced from phoenix_pubsub's changelog.

2.3.0 (2026-08-25)

Enhancements

  • Add :group_by option to choose Registry sharding strategy
  • Add configurable default dispatcher
  • Add unsubscribe function that matches on metadata

Bug fixes

  • Properly delete objects in tracker state
Commits

Updates sobelow from 0.14.1 to 0.15.0

Release notes

Sourced from sobelow's releases.

v0.15.0

What's Changed

New Contributors

Full Changelog: sobelow/sobelow@v0.14.1...v0.15.0

Changelog

Sourced from sobelow's changelog.

v0.15.0

  • Bug fixes
    • Config.Secrets no longer crashes the scan when a secret is written as anything other than a plain double-quoted string. Heredoc values and values containing escaped quotes previously raised a MatchError and aborted the entire run. These secrets are now reported, using the line of the enclosing config call.
    • A corrupt or unreadable version-check cache file no longer aborts the scan. Sobelow previously printed "This does not appear to be a Phoenix application" and exited 0 — a CI gate could pass having scanned nothing.
    • --strict now reports syntax errors instead of raising. It has been broken since Elixir 1.13 changed the error shape returned by Code.string_to_quoted/2. Errors are now reported as file:line:column:.
    • A template that cannot be parsed is now skipped (or reported under --strict) rather than aborting the scan with an EEx.SyntaxError. The error now names the offending template instead of nofile.
    • A malformed .sobelow-conf now produces an actionable message instead of a raw MatchError stacktrace. This mattered more since v0.14.1 began reading the file automatically.
    • An empty, whitespace-only, or comment-only .sobelow-conf is now read as no options rather than aborting the scan. Such a file parses to an empty block instead of a keyword list, so it originally crashed with a FunctionClauseError and then, once that was fixed, exited 1 with a configuration error. Since the file is read automatically, a stray touch .sobelow-conf or a truncated write was enough to break every scan in a project. Contents that cannot be interpreted are still an error.
    • --save-config now stores ignore_files relative to the project root. Absolute paths were previously baked into .sobelow-conf, breaking the committed file on every other machine and in CI.
    • Config.Secrets now reports the line of the secret itself when a config call spans multiple lines. The line search compared a tuple against an integer, so it never worked as intended.
    • An unwritable ~/.sobelow no longer fails a scan.
    • Fixed a string-interpolation typo that rendered dot-access variables as conn.${atom_to_string(field)}.
    • .sobelow-conf keys are now genuinely sorted alphabetically.
    • A .sobelow-conf can no longer stop Sobelow from scanning. --save-config wrote version into every file it generated, so mix sobelow --version --save-config produced a committed file that made every later run print the version and exit 0 — a CI gate reading that as a clean scan. version, details, all-details, save-config, and diff choose what Sobelow does rather than configure a scan, and are now accepted on the command line only. One in the file is ignored, with a warning when it would have changed anything. version is no longer written to the file in the first place.
    • # sobelow_skip comments are no longer thrown away over whitespace. The pattern demanded exactly one space after the # and exactly one before the list, so # sobelow_skip["XSS.Raw"], # sobelow_skip ["XSS.Raw"], and # sobelow_skip [ "XSS.Raw" ] were all ignored — silently, and indistinguishably from a skip that had simply not applied. Spacing around

... (truncated)

Commits
  • 4eb7d16 version bump - 0.15.0
  • 1a9e9ff fix: Stop .sobelow-conf from being able to disable the scan
  • c5e71f7 fix: Only match unqualified query/query! where Ecto is in scope
  • d112cc5 Potential fix for code scanning alert no. 1: Workflow does not contain permis...
  • cc5721a fix: Stop discarding # sobelow_skip comments over whitespace, and warn
  • 23a6ce5 test: Cover pipeline skip scoping across multiple pipelines
  • 7578758 fix: handle a disabled router on every resolution path
  • eb28ed4 Allow possibility to remove missing router warning (issue #25)
  • f7a2aed fix: sort the whole skips file, and by parsed location
  • 9a543aa Reduce churn: Sort lines in .sobelow-skips file...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the mix-minor group with 7 updates
ac9ed52 
Bumps the mix-minor group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [castore](https://github.com/elixir-mint/castore) | `1.0.20` | `1.0.21` |
| [guardian](https://github.com/ueberauth/guardian) | `2.4.0` | `2.5.0` |
| [phoenix](https://github.com/phoenixframework/phoenix) | `1.8.9` | `1.8.12` |
| [phoenix_live_reload](https://github.com/phoenixframework/phoenix_live_reload) | `1.6.2` | `1.7.0` |
| [phoenix_live_view](https://github.com/phoenixframework/phoenix_live_view) | `1.2.7` | `1.2.10` |
| [phoenix_pubsub](https://github.com/phoenixframework/phoenix_pubsub) | `2.2.0` | `2.3.0` |
| [sobelow](https://github.com/sobelow/sobelow) | `0.14.1` | `0.15.0` |


Updates `castore` from 1.0.20 to 1.0.21
- [Commits](elixir-mint/castore@v1.0.20...v1.0.21)

Updates `guardian` from 2.4.0 to 2.5.0
- [Release notes](https://github.com/ueberauth/guardian/releases)
- [Changelog](https://github.com/ueberauth/guardian/blob/master/CHANGELOG.md)
- [Commits](ueberauth/guardian@v2.4.0...v2.5.0)

Updates `phoenix` from 1.8.9 to 1.8.12
- [Release notes](https://github.com/phoenixframework/phoenix/releases)
- [Changelog](https://github.com/phoenixframework/phoenix/blob/v1.8.12/CHANGELOG.md)
- [Commits](phoenixframework/phoenix@v1.8.9...v1.8.12)

Updates `phoenix_live_reload` from 1.6.2 to 1.7.0
- [Changelog](https://github.com/phoenixframework/phoenix_live_reload/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/phoenix_live_reload@v1.6.2...v1.7.0)

Updates `phoenix_live_view` from 1.2.7 to 1.2.10
- [Release notes](https://github.com/phoenixframework/phoenix_live_view/releases)
- [Changelog](https://github.com/phoenixframework/phoenix_live_view/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/phoenix_live_view@v1.2.7...v1.2.10)

Updates `phoenix_pubsub` from 2.2.0 to 2.3.0
- [Changelog](https://github.com/phoenixframework/phoenix_pubsub/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/phoenix_pubsub@v2.2.0...v2.3.0)

Updates `sobelow` from 0.14.1 to 0.15.0
- [Release notes](https://github.com/sobelow/sobelow/releases)
- [Changelog](https://github.com/sobelow/sobelow/blob/main/CHANGELOG.md)
- [Commits](sobelow/sobelow@v0.14.1...v0.15.0)

---
updated-dependencies:
- dependency-name: castore
  dependency-version: 1.0.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-minor
- dependency-name: guardian
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-minor
- dependency-name: phoenix
  dependency-version: 1.8.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-minor
- dependency-name: phoenix_live_reload
  dependency-version: 1.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: mix-minor
- dependency-name: phoenix_live_view
  dependency-version: 1.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-minor
- dependency-name: phoenix_pubsub
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-minor
- dependency-name: sobelow
  dependency-version: 0.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: mix-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update Elixir code labels Aug 31, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 31, 2026 10:04
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update Elixir code labels Aug 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file elixir Pull requests that update Elixir code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants