build(deps): bump the runtime-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the runtime-dependencies group with 3 updates in the / directory: bandit, jose and req.

Updates bandit from 1.12.0 to 1.12.4

Changelog

Sourced from bandit's changelog.

1.12.4 (27 July 2026)

Fixes

• Properly send Connection: close header when client requests closure (#617)
• Disallow transfer-encoding on HTTP/1.0 connections (#618)
• Reject requests with multiple Host headers (#619)
• Reject malformed header lines (#620)
• Fix handling of chunk extensions (#621)

Enhancements

• Tighten up CI against supply chain attacks (#623, thanks @​Totara-thib!)
• Reorganize and increase coverage of HTTP/1 tests to better match RFC structure (#616)
• Tolerate a leading newline on HTTP/1 requests (#622)
• Send "100 Continue" interim response before reading body if client requests it (#624)

1.12.3 (25 July 2026)

Enhancements

• Cache connection-level data between HTTP/1 keepalives (#603, thanks @​preciz!)

1.12.2 (25 July 2026)

Enhancements

• Improve internal HTTP/2 error handling to be better about closing stream/connection
• Coalesce header and body in to single transport send (#606, thanks @​NelsonVides!)
• Improve compression behaviour when streaming an explicitly length delimited body (#605, thanks @​elibosley!)
• Quiet WebSocket deserialization erorrs, add verbosity config lever (#610, thanks @​ericmj!)
• Send connection: close when we're at max_requests (#613, thanks @​joshdchang!)

Fixes

• Fix bogus check for unmasked WebSocket frames (GHSA-rhh8-5xw9-c3gm, thanks @​lukaszsamson!)
• Enforce max_header_list_size if overridden (GHSA-9q5m-g6v3-6772, thanks @​lukaszsamson!)

1.12.1 (24 July 2026)

Fixes

• Fix DoS issue with fragmented WebSocket frames (CVE-2026-65623, thanks @​PJUllrich!)

Commits

• 00d532f Version bump to 1.12.4
• 1663203 Handle clients sending an Expect: 100-continue header before sending a body...
• e3c6595 Fixup linting error
• c430bf5 Reapply "Pin GitHub Actions to commit SHAs (#623)"
• a6fabe8 Revert "Pin GitHub Actions to commit SHAs (#623)"
• e479c3b Pin GitHub Actions to commit SHAs (#623)
• eba04e4 Tolerate a leading empty line before the request line (RFC9112§2.2) (#622)
• c31e9e3 Fix crash on unrecognized chunk extensions (#621)
• c24bc00 Reject header values containing CR, LF, or NUL (#620)
• a518b29 Reject requests with multiple Host headers (#619)
• Additional commits viewable in compare view

Updates jose from 1.11.10 to 1.11.12

Release notes

Sourced from jose's releases.

1.11.12 (2025-11-20)

• Fixes
  • Properly handle nil from Elixir maps when encoding with the builtin json Erlang/OTP module; see #184
  • Drop required Elixir version back from 1.16 -> 1.13; see #185

1.11.11 (2025-11-17)

• Fixes
  • EC key decode/encode issues in OTP 28; see #180, #181, #182, #179
  • EdDSA key issues with OTP 27.1.3+; see #177
• Notes
  • This will hopefully be one of the last 1.x releases, next release will be 2.x

Changelog

Sourced from jose's changelog.

1.11.12 (2025-11-20)

• Fixes
  • Properly handle nil from Elixir maps when encoding with the builtin json Erlang/OTP module; see #184
  • Drop required Elixir version back from 1.16 -> 1.13; see #185

1.11.11 (2025-11-17)

• Fixes
  • EC key decode/encode issues in OTP 28; see #180, #181, #182, #179
  • EdDSA key issues with OTP 27.1.3+; see #177
• Notes
  • This will hopefully be one of the last 1.x releases, next release will be 2.x

Commits

• c8b669c Version 1.11.12
• 07705f5 Fix breaking changes to JSON encoding and Elixir requirements, resolves #184,...
• be56c1e Version 1.11.11
• 25bae5d Update CI Matrix, resolves #175
• d2edf6d Merge branch from couchbasedeps/erlang-jose#2
• b4b2052 Fix EC key conversion for OTP 28, resolves #180, resolves #181, resolves #182...
• 49b5aca Fix: Add EdDSA key support for OTP 27.1.3+
• b635b6d Update rebar.config
• 069ac55 Run 'make format'
• e63bb3b Update erlang.mk and Makefile
• Additional commits viewable in compare view

Updates plug from 1.19.2 to 1.20.3

Changelog

Sourced from plug's changelog.

v1.20.3 (2026-07-09)

Security

• [Plug.Parsers.MULTIPART] Count files and skipped multipart parts towards the length limit (CVE-2026-56814)
• [Plug.Conn.Cookies] Raise if ; is present in cookie attributes (CVE-2026-56813)

v1.20.2 (2026-06-30)

Bug fixes

• [Plug.Conn] Set state to :set_upgrade and status to 101 when running before_send callbacks for upgrades

v1.20.1 (2026-06-23)

Bug fixes

• [Plug.Conn] Fix inform/inform! when atoms are given as header keys

v1.20.0 (2026-06-23)

This release requires Elixir v1.15+.

Enhancements

• [Plug.RequestId] Make request ID generation configurable
• [Plug.Test] Support :sign and :encrypt options in put_req_cookie/4

Bug fixes

• [Plug.Conn] Run before_send callbacks before upgrade_adapter/3
• [Plug.Debugger] Raise if Elixir is compiled without source information
• [Plug.RewriteOn] Rewrite the protocol to HTTPS when x-forwarded-proto is wss
• [Plug.Static] Return 416 for invalid range requests
• [Plug.Static] Fix :raise_on_missing_only raising on non-matching paths with colons

Optimizations

• [Plug.Conn.Cookies] Optimize cookie parsing
• [Plug.Conn.Cookies] Optimize cookie encoding
• [Plug.Conn.Utils] Optimize validate_utf8!/3
• [Plug.Conn.Utils] Optimize splitting by semicolons
• [Plug.Router] Optimize host matching

v1.19.5 (2026-07-09)

Security

• [Plug.Parsers.MULTIPART] Count files and skipped multipart parts towards the length limit (CVE-2026-56814)
• [Plug.Conn.Cookies] Raise if ; is present in cookie attributes (CVE-2026-56813)

... (truncated)

Commits

• 9fa11c8 Release v1.20.3
• eceb831 Raise if ; is present in cookie attributes
• 56edca2 Count files and skipped multiparts towards length
• cf15f0a Release v1.20.2
• 5d0fe88 Fix register_before_send with upgrade_adapter (#1320)
• 1fea083 Release v1.20.1
• 9df2c0a Allow atom header keys in inform/3 (#1318)
• d8d733b Release v1.20.0
• b4aa8a0 Merge commit from fork
• ac94702 Validate headers in inform
• Additional commits viewable in compare view

Updates req from 0.6.1 to 0.7.1

Changelog

Sourced from req's changelog.

v0.7.1 (2026-07-28)

• Deprecate cache: true/[cache] step. It will be removed in Req v0.8. I plan a comprehensive cache solution for Req v1.0+.

v0.7.0 (2026-07-28)

• [Req]: Add Req.new(req, options).

• [Req]: Treat URL userinfo as Basic Authentication.

• [Req], [Req.Request]: Deprecate adapter: fun in favour of adapter: mod.

• [Req.Request]: (BREAKING CHANGE) Remove current_request_steps field.

• [Req.Request]: Fix redacting remaining auth values.

• (BREAKING CHANGE) Replace run_finch step with [Req.Finch] adapter module.

• (BREAKING CHANGE) Replace put_plug and run_plug steps with [Req.Plug] adapter module.

• [Req.Finch]: Support finch: options.

• [Req.Finch]: Support :request_timeout.

• [Req.Finch]: Fix handling duplicate response headers.

• [Req.Finch]: Deprecate finch: name in favour of finch: [name: name].

• [Req.Finch]: Deprecate pool_timeout: value in favour of finch: [pool_timeout: value].

• [Req.Finch]: Deprecate pool_max_idle_time: value in favour of finch: [pool_max_idle_time: value].

• [Req.Finch]: Deprecate :finch_request.

• [Req.Plug]: Handle individual response body chunks.

• [Req.Plug]: Support non-UTF8 request params.

• [Req.Plug]: Put original request private data in conn.private.

• [Req.Test]: Allow descendant processes.

• [Req.Test]: Fix concurrent plug fetches immediately after switching to shared mode.

• [compress_body]: Do nothing when request content-encoding is already set.

• [compress_body]: Update multipart boundary when re-running the step.

• [compressed], [decode_body]: Replace optional ezstd dependency with Erlang/OTP 28+ built-in :zstd.

... (truncated)

Commits

• 168a11e Release v0.7.1
• a9c24a1 Deprecate cache: true/cache step
• 6a4f305 Release v0.7.0
• d770830 Hide body: fun for now
• e450b25 Update CI
• 8123419 Fix flaky httpc into: fun test
• fb7bb10 Revert "New step: expect (#493)"
• ed894af Revert "Add assigns (#492)"
• c47a208 Update docs
• be40081 Req.Finch: Deprecate :finch_request
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

TCK 1.0-dev Compatibility Results (experimental)

This run is informational — failures do not block CI.

             A2A TCK Compatibility Report              
═══════════════════════════════════════════════════════
SUT: http://localhost:9999
Timestamp: 2026-07-28T19:35:40.203074+00:00

OVERALL COMPATIBILITY: 71.6%

┌─────────────┬────────┬────────┬─────────┬───────┐
│ Level       │ Passed │ Failed │ Skipped │ Total │
├─────────────┼────────┼────────┼─────────┼───────┤
│ MUST        │     44 │     35 │      35 │   114 │
│ SHOULD      │      2 │      9 │       0 │    11 │
│ MAY         │      2 │      2 │       0 │     4 │
└─────────────┴────────┴────────┴─────────┴───────┘

BY TRANSPORT:
  agent_card:    8/10 ⚠
  grpc:          0/72 (72 skipped) ✓
  jsonrpc:       50/100 (30 skipped) ⚠
  http_json:     3/83 (80 skipped) ✓

FAILED REQUIREMENTS:
  ✗ CARD-CACHE-002 (agent_card): Agent Card response should include an ETag header
  ✗ CARD-CACHE-003 (agent_card): Agent Card response may include a Last-Modified header
  ✗ DM-ART-001 (): Response contains no artifacts
  ✗ DM-MSG-001 (): Expected a Message response, but got a Task or no payload
  ✗ JSONRPC-SSE-002 (): Error code mismatch: expected ContentTypeNotSupportedError (-32005), got ParseError (-32700)
  ✗ JSONRPC-ERR-003 (): error.data is absent — A2A errors MUST include ErrorInfo in data array
  ✗ CORE-MULTI-004 (jsonrpc): Expected error code -32001 (TaskNotFoundError), got -32603
  ✗ CORE-HIST-001 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-HIST-002 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-HIST-003 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-HIST-004 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-HIST-005 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-HIST-006 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-GET-001 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_COMPLETED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-CANCEL-001 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-CANCEL-002 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_COMPLETED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-SEND-002 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_COMPLETED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-MULTI-005 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")