Skip to content

chore(deps): bump the all-dependencies group across 1 directory with 9 updates - #15

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/all-dependencies-45e313ef3d
Closed

chore(deps): bump the all-dependencies group across 1 directory with 9 updates#15
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/all-dependencies-45e313ef3d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the all-dependencies group with 9 updates in the / directory:

Package From To
bandit 1.12.5 1.13.1
dune 0.3.17 0.3.18
ex_check 0.16.0 0.17.0
mimic 2.4.1 2.4.2
quiver 0.4.1 0.4.2
recode 0.8.0 0.9.0
spark 2.7.2 2.7.8
sycophant 0.5.1 0.8.0
tidewave 0.9.0 0.9.1

Updates bandit from 1.12.5 to 1.13.1

Changelog

Sourced from bandit's changelog.

1.13.1 (15 Oct 2026)

Reverts

  • Revert the stale conn check added in 1.13.0 (#668), since a number of valid code paths in Phoenix depend on stale conns (notably, Plug.Parsers errors rendered by Phoenix.Endpoint.RenderErrors). See elixir-plug/plug#1331

1.13.0 (15 Oct 2026)

Enhancements

Changes

  • Require Thousand Island 1.6, and use the peername it now captures when it accepts a connection (#718)
  • Require hpax 1.1 and drop the nil field value workaround (#706, thanks @​acrogenesis!)
  • Report conn.port as an integer for CONNECT requests, as Plug.Conn requires
  • Close idle connections which send no bytes silently instead of answering 408 (#689, thanks @​tomciopp!)
  • RFC Conformance: Enforce Host requirements for HTTP/1.1 targets (#679, thanks @​mpettibone!)
  • RFC Conformance: Complete HTTP/2 field validation (#680, thanks @​mpettibone!)
  • RFC Conformance: Validate HTTP/2 content length on initial END_STREAM (#681, thanks @​mpettibone!)
  • RFC Conformance: Enforce HTTP/2 trailer field section requirements (#682, thanks @​mpettibone!)
  • RFC Conformance: Validate request transfer coding before Plug dispatch (#683, thanks @​mpettibone!)
  • RFC Conformance: Fix HTTP/1.0 streaming response framing (#684, thanks @​mpettibone!)
  • RFC Conformance: Accept empty non-final WebSocket continuation frames (#685, thanks @​mpettibone!)
  • RFC Conformance: Validate WebSocket client keys (#686, thanks @​mpettibone!)

Fixes

  • Validate the authority of HTTP/1 absolute-form and authority-form request targets against the same grammar as the Host header (GHSA-v53v-9hvg-37jf, thanks @​euriconicacio!)
  • Bound HTTP/2 sends blocked on a send window by progress, so that a trickle of window updates can no longer keep a stream pinned indefinitely (GHSA-69m6-wcv4-rwcf, thanks @​tomciopp!)
  • Reject control bytes in HTTP/1 request targets (#713, #711, thanks @​PJUllrich!)
  • Fix crash when a client resets an HTTP/1 connection before Bandit reads its peer address (#718, #717, thanks @​mhsdef!)
  • Drain all queued HTTP/2 DATA frames of an unread body once a response has been sent (#710, #697, thanks @​jamilbk!)
  • Preserve independent error responses on HTTP/1 keep-alive and pipelined requests, and frame empty 4xx/5xx error responses with Content-Length: 0 (#705, thanks @​jeregrine!)
  • Close instead of draining when a plug never honors Expect: 100-continue (#695, thanks @​tomciopp!)
  • Fix chunked read_body(length: 0) falsely completing the body (#691, thanks @​tomciopp!)
  • Observe RST_STREAM while blocked on the stream send window (#688, thanks @​tomciopp!)

... (truncated)

Commits

Updates dune from 0.3.17 to 0.3.18

Changelog

Sourced from dune's changelog.

v0.3.18 (2026-10-07)

  • Add a :parse_timeout option to specify the maximum time spent during parsing. Prior to this change, the parsing task might have timed out after 5000ms, the new value defaults to the same value as the :timeout option.
  • Relax type of :timeout option to allow any t:timeout/0.
Commits

Updates ex_check from 0.16.0 to 0.17.0

Updates mimic from 2.4.1 to 2.4.2

Release notes

Sourced from mimic's releases.

Mimic 2.4.2

What's Changed

Full Changelog: edgurgel/mimic@v2.4.1...v2.4.2

Changelog

Sourced from mimic's changelog.

2.4.2 (2026-09-18)

  • fix: release global mode when the test that set it finishes. It was handed back asynchronously with nothing waiting on it, so under load a later test could find a finished test's pid still holding it and fail with "Expect cannot be called by the current process. Only the global owner is allowed."
  • breaking: set_mimic_global/1 now raises when called outside a test process. Global mode is released by an on_exit callback, which only the test process can register, so such a call took a mode that was never handed back and left the rest of the suite stuck in global mode. Call it from the test process (or a setup block) instead.
Commits

Updates quiver from 0.4.1 to 0.4.2

Release notes

Sourced from quiver's releases.

v0.4.2

0.4.2 (2026-09-25)

Bug Fixes

  • deps: Updated quic to 2.0 (94b244f)
Changelog

Sourced from quiver's changelog.

0.4.2 (2026-09-25)

Bug Fixes

  • deps: Updated quic to 2.0 (94b244f)
Commits

Updates recode from 0.8.0 to 0.9.0

Changelog

Sourced from recode's changelog.

0.9.0 - 2026/10/26

  • Change sorting in the AliasOrder task
  • Require Elixir 1.15
Commits

Updates spark from 2.7.2 to 2.7.8

Release notes

Sourced from spark's releases.

v2.7.8

Performance Improvements:

  • don't generate error messages we'll never display by Zach Daniel

v2.7.7

Improvements:

  • give auto identifiers a value the next compilation agrees on by Thomas Anagrius

Bug Fixes:

  • don't call to_string on a tuple, improving compile times by Zach Daniel

v2.7.6

Improvements:

  • add :depend_on_only_behaviour_modules by Zach Daniel

v2.7.5

Improvements:

  • don't incur compile dependencies for &Mod.fun/arity values by Zach Daniel

v2.7.4

Improvements:

  • reduce module sizes and compile times by Zach Daniel

v2.7.3

... (truncated)

Changelog

Sourced from spark's changelog.

v2.7.8 (2026-10-16)

Performance Improvements:

  • don't generate error messages we'll never display by Zach Daniel

v2.7.7 (2026-10-16)

Improvements:

  • give auto identifiers a value the next compilation agrees on by Thomas Anagrius

Bug Fixes:

  • don't call to_string on a tuple, improving compile times by Zach Daniel

v2.7.6 (2026-10-04)

Improvements:

  • add :depend_on_only_behaviour_modules by Zach Daniel

v2.7.5 (2026-10-04)

Improvements:

  • don't incur compile dependencies for &Mod.fun/arity values by Zach Daniel

v2.7.4 (2026-10-04)

Improvements:

  • reduce module sizes and compile times by Zach Daniel

v2.7.3 (2026-09-15)

... (truncated)

Commits
  • dd624b9 chore: release version v2.7.8
  • c2a2912 perf: don't generate error messages we'll never display
  • 21466a7 chore: release version v2.7.7
  • ed317cc fix: don't call to_string on a tuple, improving compile times
  • cbc072d improvement: give auto identifiers a value the next compilation agrees on
  • 7e0e4f3 chore: release version v2.7.6
  • 2772d84 improvement: add :depend_on_only_behaviour_modules
  • 5399477 chore: release version v2.7.5
  • 69fa368 improvement: don't incur compile dependencies for &Mod.fun/arity values
  • 8872e7a chore: release version v2.7.4
  • Additional commits viewable in compare view

Updates sycophant from 0.5.1 to 0.8.0

Release notes

Sourced from sycophant's releases.

sycophant: v0.8.0

0.8.0 (2026-10-19)

Features

  • auth: add request_constraints callback applied by the pipeline (99781d9)
  • enable prompt caching for OpenAI, Anthropic and OpenRouter wires (3f031e7)
  • error: add SubscriptionError for ChatGPT plan failures (c0b697a)
  • oauth: add Assent, OAuth credential and session structs, and HTTP adapter (4b57616)
  • oauth: add generic authorization code, exchange, refresh, and revoke functions (75ce7f6)
  • openai: accept ChatGPT access tokens as an openai credential mode (35afdc6)
  • openai: add Sign in with ChatGPT preset, model listing, and guide (5c8c336)

Bug Fixes

  • address branch review findings for ChatGPT subscription (925e6e7)
  • openai: decode ChatGPT plan streams without content-type or final output (f19085c)
  • usage: count cached tokens in input_tokens and bill them once (fb9903d)
  • usage: count reasoning in output_tokens and bill it once (a366df7)
  • usage: Fixed cache calculation (22b29a1)

sycophant: v0.7.0

0.7.0 (2026-10-13)

Features

  • Added support to OpenAI Decisions API (035c7e8)

Bug Fixes

  • preserve streaming errors and reasoning summaries (b09b4d3)

sycophant: v0.6.0

0.6.0 (2026-09-25)

Features

  • evaluation: add EvaluationAnswer and EvaluationResponse structs (32187c7)
  • evaluation: add EvaluationRequest with question validation (d7ea943)
  • evaluation: add EvaluationWireProtocol and TypeSafe System One adapter (4b17c91)
  • evaluation: add Sycophant.evaluate/4 and the evaluation pipeline (b1ccb3d)
  • evaluation: resolve evaluation models and reject chat calls on non-chat models (a9e370b)
  • openrouter: add Decisions adapter for evaluation models (c682e86)
  • otel: translate evaluation telemetry into OpenTelemetry spans (4d6904b)
  • provider: Added support to WanDB (0639ec6)
Changelog

Sourced from sycophant's changelog.

0.8.0 (2026-10-19)

Features

  • auth: add request_constraints callback applied by the pipeline (99781d9)
  • enable prompt caching for OpenAI, Anthropic and OpenRouter wires (3f031e7)
  • error: add SubscriptionError for ChatGPT plan failures (c0b697a)
  • oauth: add Assent, OAuth credential and session structs, and HTTP adapter (4b57616)
  • oauth: add generic authorization code, exchange, refresh, and revoke functions (75ce7f6)
  • openai: accept ChatGPT access tokens as an openai credential mode (35afdc6)
  • openai: add Sign in with ChatGPT preset, model listing, and guide (5c8c336)

Bug Fixes

  • address branch review findings for ChatGPT subscription (925e6e7)
  • openai: decode ChatGPT plan streams without content-type or final output (f19085c)
  • usage: count cached tokens in input_tokens and bill them once (fb9903d)
  • usage: count reasoning in output_tokens and bill it once (a366df7)
  • usage: Fixed cache calculation (22b29a1)

0.7.0 (2026-10-13)

Features

  • Added support to OpenAI Decisions API (035c7e8)

Bug Fixes

  • preserve streaming errors and reasoning summaries (b09b4d3)

0.6.0 (2026-09-25)

Features

  • evaluation: add EvaluationAnswer and EvaluationResponse structs (32187c7)
  • evaluation: add EvaluationRequest with question validation (d7ea943)
  • evaluation: add EvaluationWireProtocol and TypeSafe System One adapter (4b17c91)
  • evaluation: add Sycophant.evaluate/4 and the evaluation pipeline (b1ccb3d)
  • evaluation: resolve evaluation models and reject chat calls on non-chat models (a9e370b)
  • openrouter: add Decisions adapter for evaluation models (c682e86)
  • otel: translate evaluation telemetry into OpenTelemetry spans (4d6904b)
  • provider: Added support to WanDB (0639ec6)
Commits
  • 7350794 chore(main): release sycophant 0.8.0 (#16)
  • 082841e chore: Updated deps for CVE fix
  • a366df7 fix(usage): count reasoning in output_tokens and bill it once
  • fb9903d fix(usage): count cached tokens in input_tokens and bill them once
  • 3f031e7 feat: enable prompt caching for OpenAI, Anthropic and OpenRouter wires
  • 22b29a1 fix(usage): Fixed cache calculation
  • f19085c fix(openai): decode ChatGPT plan streams without content-type or final output
  • 925e6e7 fix: address branch review findings for ChatGPT subscription
  • 5c8c336 feat(openai): add Sign in with ChatGPT preset, model listing, and guide
  • 75ce7f6 feat(oauth): add generic authorization code, exchange, refresh, and revoke fu...
  • Additional commits viewable in compare view

Updates tidewave from 0.9.0 to 0.9.1

Changelog

Sourced from tidewave's changelog.

v0.9.1 (2026-09-23)

  • Add mix tidewave.proxy
  • Add "instructions" to MCP initialization response
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the all-dependencies group across 1 directory with …
211c26c 
…9 updates

Bumps the all-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [bandit](https://github.com/mtrudel/bandit) | `1.12.5` | `1.13.1` |
| [dune](https://github.com/functional-rewire/dune) | `0.3.17` | `0.3.18` |
| ex_check | `0.16.0` | `0.17.0` |
| [mimic](https://github.com/edgurgel/mimic) | `2.4.1` | `2.4.2` |
| [quiver](https://github.com/edlontech/quiver) | `0.4.1` | `0.4.2` |
| [recode](https://github.com/hrzndhrn/recode) | `0.8.0` | `0.9.0` |
| [spark](https://github.com/ash-project/spark) | `2.7.2` | `2.7.8` |
| [sycophant](https://github.com/edlontech/sycophant) | `0.5.1` | `0.8.0` |
| [tidewave](https://github.com/tidewave-ai/tidewave_phoenix) | `0.9.0` | `0.9.1` |



Updates `bandit` from 1.12.5 to 1.13.1
- [Changelog](https://github.com/mtrudel/bandit/blob/main/CHANGELOG.md)
- [Commits](mtrudel/bandit@1.12.5...1.13.1)

Updates `dune` from 0.3.17 to 0.3.18
- [Changelog](https://github.com/functional-rewire/dune/blob/main/CHANGELOG.md)
- [Commits](functional-rewire/dune@v0.3.17...v0.3.18)

Updates `ex_check` from 0.16.0 to 0.17.0

Updates `mimic` from 2.4.1 to 2.4.2
- [Release notes](https://github.com/edgurgel/mimic/releases)
- [Changelog](https://github.com/edgurgel/mimic/blob/main/CHANGELOG.md)
- [Commits](edgurgel/mimic@v2.4.1...v2.4.2)

Updates `quiver` from 0.4.1 to 0.4.2
- [Release notes](https://github.com/edlontech/quiver/releases)
- [Changelog](https://github.com/edlontech/quiver/blob/main/CHANGELOG.md)
- [Commits](edlontech/quiver@v0.4.1...v0.4.2)

Updates `recode` from 0.8.0 to 0.9.0
- [Release notes](https://github.com/hrzndhrn/recode/releases)
- [Changelog](https://github.com/hrzndhrn/recode/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hrzndhrn/recode/commits)

Updates `spark` from 2.7.2 to 2.7.8
- [Release notes](https://github.com/ash-project/spark/releases)
- [Changelog](https://github.com/ash-project/spark/blob/main/CHANGELOG.md)
- [Commits](ash-project/spark@v2.7.2...v2.7.8)

Updates `sycophant` from 0.5.1 to 0.8.0
- [Release notes](https://github.com/edlontech/sycophant/releases)
- [Changelog](https://github.com/edlontech/sycophant/blob/main/CHANGELOG.md)
- [Commits](edlontech/sycophant@sycophant-v0.5.1...sycophant-v0.8.0)

Updates `tidewave` from 0.9.0 to 0.9.1
- [Changelog](https://github.com/tidewave-ai/tidewave_phoenix/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tidewave-ai/tidewave_phoenix/commits)

---
updated-dependencies:
- dependency-name: bandit
  dependency-version: 1.13.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: dune
  dependency-version: 0.3.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: ex_check
  dependency-version: 0.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: mimic
  dependency-version: 2.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: quiver
  dependency-version: 0.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: recode
  dependency-version: 0.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: spark
  dependency-version: 2.7.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: sycophant
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: tidewave
  dependency-version: 0.9.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code labels Oct 23, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 30, 2026
@dependabot
dependabot Bot deleted the dependabot/hex/all-dependencies-45e313ef3d branch October 30, 2026 17:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants