[dependabot]

Bumps the mix-minor-and-patch group with 5 updates in the /server directory:

Package	From	To
bandit	1.12.5	1.13.1
ecto_sqlite3	0.25.0	0.26.0
plug_crypto	2.2.0	2.2.1
req	0.7.4	0.7.5
sbom	0.11.0	0.12.0

Updates bandit from 1.12.5 to 1.13.1

Changelog

Sourced from bandit's changelog.

1.13.1 (15 Oct 2026)

Reverts

• Revert the stale conn check added in 1.13.0 (#668), since a number of valid code paths in Phoenix depend on stale conns (notably, Plug.Parsers errors rendered by Phoenix.Endpoint.RenderErrors). See elixir-plug/plug#1331

1.13.0 (15 Oct 2026)

Enhancements

• Add a compress_chunked option to compress chunked responses with gzip and zstd (#707, thanks @​iStefo!)
• Clarify inet6 option behaviour on dual-stack platforms (#709, #700, thanks @​adelton!)
• Unroll WebSocket masking over 32-byte blocks (#674, thanks @​mpettibone!)
• Drain HTTP/2 pending sends without repeated List.delete/2 (#673, thanks @​mpettibone!)
• Short-circuit header token lookup on the first match (#699, thanks @​claytongentry!)
• Scope the workflow tokens to what each job actually uses (#702, thanks @​Totara-thib!)
• Add a Plumber check and score badge (#712, thanks @​Totara-thib!)
• Fix recent releases changelog headings in docs (#672, thanks @​dinokovac-river!)

Changes

• Require Thousand Island 1.6, and use the peername it now captures when it accepts a connection (#718)
• Require hpax 1.1 and drop the nil field value workaround (#706, thanks @​acrogenesis!)
• Report conn.port as an integer for CONNECT requests, as Plug.Conn requires
• Close idle connections which send no bytes silently instead of answering 408 (#689, thanks @​tomciopp!)
• RFC Conformance: Enforce Host requirements for HTTP/1.1 targets (#679, thanks @​mpettibone!)
• RFC Conformance: Complete HTTP/2 field validation (#680, thanks @​mpettibone!)
• RFC Conformance: Validate HTTP/2 content length on initial END_STREAM (#681, thanks @​mpettibone!)
• RFC Conformance: Enforce HTTP/2 trailer field section requirements (#682, thanks @​mpettibone!)
• RFC Conformance: Validate request transfer coding before Plug dispatch (#683, thanks @​mpettibone!)
• RFC Conformance: Fix HTTP/1.0 streaming response framing (#684, thanks @​mpettibone!)
• RFC Conformance: Accept empty non-final WebSocket continuation frames (#685, thanks @​mpettibone!)
• RFC Conformance: Validate WebSocket client keys (#686, thanks @​mpettibone!)

Fixes

• Validate the authority of HTTP/1 absolute-form and authority-form request targets against the same grammar as the Host header (GHSA-v53v-9hvg-37jf, thanks @​euriconicacio!)
• Bound HTTP/2 sends blocked on a send window by progress, so that a trickle of window updates can no longer keep a stream pinned indefinitely (GHSA-69m6-wcv4-rwcf, thanks @​tomciopp!)
• Reject control bytes in HTTP/1 request targets (#713, #711, thanks @​PJUllrich!)
• Fix crash when a client resets an HTTP/1 connection before Bandit reads its peer address (#718, #717, thanks @​mhsdef!)
• Drain all queued HTTP/2 DATA frames of an unread body once a response has been sent (#710, #697, thanks @​jamilbk!)
• Preserve independent error responses on HTTP/1 keep-alive and pipelined requests, and frame empty 4xx/5xx error responses with Content-Length: 0 (#705, thanks @​jeregrine!)
• Close instead of draining when a plug never honors Expect: 100-continue (#695, thanks @​tomciopp!)
• Fix chunked read_body(length: 0) falsely completing the body (#691, thanks @​tomciopp!)
• Observe RST_STREAM while blocked on the stream send window (#688, thanks @​tomciopp!)

... (truncated)

Commits

• ee75d31 Version bump to 1.13.1
• 84e9d1d Revert "Guard against stale conn reuse in Bandit.Adapter (#668)" (#719)
• d6daa4a Version bump to 1.13.0
• 02a3853 Add a Plumber check and score badge (#712)
• 0c53a6e Require Thousand Island 1.6 and use its cached peername (#718)
• 8993dae Bump finch from 0.21.0 to 0.24.0 (#716)
• 6ea8021 Merge commit from fork
• 2758910 Bump req from 0.7.4 to 0.7.5 (#715)
• 70014a0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#714)
• c95938d Reject control bytes in HTTP/1 request targets (#713)
• Additional commits viewable in compare view

Updates ecto_sqlite3 from 0.25.0 to 0.26.0

Changelog

Sourced from ecto_sqlite3's changelog.

v0.26.0

• changed: Bump minimum version of exqlite to ~> 0.40.
• changed: Raise on incorrect use of drop mode.
• added: Support rendering :modifiers in CREATE TABLE commands.
• added: Support check constraints via Ecto.Migration.constraint/3.
• changed: Reimplement querying prefix names.
• added: Raise on cross-database foreign keys.
• changed: Made quote_name/1 private.
• changed: quote_name no longer accepts names with double quote.

Commits

• d25d4aa feat: bump to v0.26.0
• aef454e chore: bump minimum exqlite version to ~0.40
• cc2a7c2 chore(ci): update checkout and cache
• a9b5129 Test query returns no result without prefix
• 8f117d3 Support modifiers and drop mode
• d0ad056 Stricter testing for raised error messages
• 3b1a832 Support table-level check constraints
• 57325b4 Fix incorrectly named BinaryUUIDTest that didn't get loaded
• ae81964 Remove deprecated parentheses after field access usage in tests
• d660df7 use :prefix to query attached databases (#183)
• See full diff in compare view

Updates plug_crypto from 2.2.0 to 2.2.1

Changelog

Sourced from plug_crypto's changelog.

v2.2.1 (2026-10-23)

• Avoid secret key base from being written to logs in case of bad args (CVE-2026-105963) (GHSA-ffw9-w85g-f2vh)

Commits

• 9b36a12 Release v2.2.1
• 9818874 Avoid secret key base from being written to logs in case of bad args
• 09955be Differentiate between secret and salt in docs (#53)
• See full diff in compare view

Updates req from 0.7.4 to 0.7.5

Release notes

Sourced from req's releases.

v0.7.5

• put_aws_sigv4: Fix SigV4 signing on retries.
• redirect: Change method to GET (except HEAD) on HTTP 303. Thanks to @​euriconicacio for reporting this.

Changelog

Sourced from req's changelog.

v0.7.5 (2026-10-06)

• [put_aws_sigv4]: Fix SigV4 signing on retries.
• [redirect]: Change method to GET (except HEAD) on HTTP 303.

Commits

• 2ce74f1 Release v0.7.5
• 10c7414 Fix connect timeout test
• 331c5d9 Fix SigV4 signing on retries
• bd18cb2 redirect: Change method to GET (except HEAD) on HTTP 303
• See full diff in compare view

Updates sbom from 0.11.0 to 0.12.0

Release notes

Sourced from sbom's releases.

v0.12.0

What's Changed

• Build burrito targets in parallel via matrix by @​maennchen in erlef/mix_sbom#156
• Keep the application version in the purl for Erlang apps by @​Hermanverschooten in erlef/mix_sbom#158
• Add vulnerabilities from OSV.dev by @​igorgbr in erlef/mix_sbom#160
• Accept optional applications in application/0 by @​maennchen in erlef/mix_sbom#169

Dependency Updates

• Update ghcr.io/oss-review-toolkit/ort Docker tag to v94.2.0 by @​renovate[bot] in erlef/mix_sbom#159
• Bump the github-actions group with 2 updates by @​dependabot[bot] in erlef/mix_sbom#161
• Update ghcr.io/oss-review-toolkit/ort Docker tag to v95 by @​renovate[bot] in erlef/mix_sbom#162
• Update ghcr.io/oss-review-toolkit/ort Docker tag to v96 by @​renovate[bot] in erlef/mix_sbom#163
• Bump the github-actions group with 4 updates by @​dependabot[bot] in erlef/mix_sbom#165
• Bump protobuf from 0.17.0 to 0.17.1 in the mix-dependencies group by @​dependabot[bot] in erlef/mix_sbom#164
• Allow hex_core 0.20 by @​maennchen in erlef/mix_sbom#168
• Update ghcr.io/oss-review-toolkit/ort Docker tag to v97 by @​renovate[bot] in erlef/mix_sbom#167

New Contributors

• @​igorgbr made their first contribution in erlef/mix_sbom#160

Full Changelog: erlef/mix_sbom@v0.11.0...v0.12.0

Commits

• 96bb84f Release v0.12.0
• a821425 Accept optional applications in application/0 (#169)
• 4639073 Allow hex_core 0.20 (#168)
• bbc248f Update ghcr.io/oss-review-toolkit/ort Docker tag to v97 (#167)
• ebbbefb Bump protobuf from 0.17.0 to 0.17.1 in the mix-dependencies group (#164)
• 22d0b50 Bump the github-actions group with 4 updates (#165)
• 92ad599 Add vulnerabilities from OSV.dev (#160)
• 06ac313 Update ghcr.io/oss-review-toolkit/ort Docker tag to v96 (#163)
• 38b9a28 Update ghcr.io/oss-review-toolkit/ort Docker tag to v95 (#162)
• 9904379 Bump the github-actions group with 2 updates (#161)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions