[dependabot]

Bumps the all-dependencies group with 11 updates in the / directory:

Package	From	To
bandit	1.12.5	1.14.0
dune	0.3.17	0.3.18
ex_check	0.16.0	0.17.1
igniter	0.8.4	0.8.5
mimic	2.4.1	2.4.2
quiver	0.4.1	0.4.2
recode	0.8.0	0.9.0
spark	2.7.2	2.7.9
sycophant	0.5.1	0.8.0
tidewave	0.9.0	0.9.2
usage_rules	1.2.8	1.3.0

Updates bandit from 1.12.5 to 1.14.0

Changelog

Sourced from bandit's changelog.

1.14.0 (26 Oct 2026)

Changes

• Advertise a default HTTP/2 max_concurrent_streams of 500 and a default max_header_list_size of 262144 bytes in the initial SETTINGS frame. Before, both were unlimited. The entries of a SETTINGS frame are now sorted
• Refill the HTTP/2 connection receive window to 16 MiB as data arrives. Refill a stream receive window to 1 MiB only after the stream reads data. Before, the server granted 2^31-1 bytes on the first DATA frame
• Join HTTP/2 DATA frames into larger messages when a stream is slow to read. As a result, read_body can return more than :length bytes, up to the stream receive window
• Reset an HTTP/2 stream with ENHANCE_YOUR_CALM when it has 100 unread messages, and close the connection with ENHANCE_YOUR_CALM when a client sends more than 100 non-ACK SETTINGS frames in 10 seconds
• Reset an HTTP/2 stream with STREAM_CLOSED when the client sends DATA or HEADERS after END_STREAM
• Send PROTOCOL_ERROR for DATA, WINDOW_UPDATE and RST_STREAM on an idle HTTP/2 stream, and report the last stream that the server started in the GOAWAY frame
• Reject an HTTP/1 absolute-form request target whose path :erlang.decode_packet/3 reads differently from RFC 3986. As a result, a target with an empty path followed by a query (for example http://host:80?a=b) now gets 400. Before, its query was silently discarded
• Require the HTTP/1 request line to have exactly three words, and the version to be exactly HTTP/1.1 or HTTP/1.0
• Accept optional whitespace before the ; of a chunk extension, as RFC 9112 §7.1.1 permits
• Report port 0 in an absolute-form request target as conn.port == 0, the same as for a Host header. Before, it was reported as the scheme's default port
• After a server-initiated WebSocket close, close the connection when the close timeout passes, even if the peer keeps sending frames or sends nothing. The close timeout is the WebSock timeout option, else the read_timeout, else 60 seconds when the timeout is :infinity

Fixes

• Enforce the HTTP/2 connection and stream receive windows, and count padding against them, so that a client cannot queue DATA without bound in a stream (CVE-2026-108525, thanks @​PJUllrich!, GHSA-pxfw-2r8w-g3jv, thanks @​manus-pi!)
• Limit concurrent HTTP/2 streams by default (GHSA-fmr8-qrvr-4ww5, thanks @​neilberkman!)
• Bound an HTTP/2 body read with one deadline, which frames that carry no data do not restart (CVE-2026-115269, thanks @​manus-pi!)
• Do not send work to every HTTP/2 stream on SETTINGS frames that do not change the initial window size, and keep pending sends in a queue (CVE-2026-108529, thanks @​PJUllrich!)
• Limit the decoded HTTP/2 header list size by default (CVE-2026-109584, thanks @​PJUllrich!, GHSA-ggpf-wvx5-f4h8, thanks @​neilberkman!)
• Cap the HTTP/2 HPACK encoder table at 4096 bytes, whatever size the client requests (CVE-2026-110499, thanks @​PJUllrich!)
• Keep the HTTP/2 connection state and HPACK decoder state when a stream error occurs in the middle of a read, so that per-connection limits still apply (CVE-2026-111103, thanks @​PJUllrich!, GHSA-q48c-59mm-jx3c, thanks @​neilberkman!)
• Collect chunked HTTP/1 request bodies into one binary, so that a body sent as many tiny chunks no longer uses many times its size in memory (CVE-2026-111101, thanks @​PJUllrich!)

... (truncated)

Commits

• 220b9df Version bump to 1.14.0
• 3ee18fd Merge commit from fork
• 7dd7712 Merge commit from fork
• 124828c Merge commit from fork
• e327ac2 Send RST_STREAM when an HTTP/2 stream process is killed (#708)
• f9d0df4 Return from HTTP/2 read_body once the length option is reached (#723)
• 76f0ef5 Answer a malformed Sec-WebSocket-Extensions header with a 400 (#724)
• 18fb153 Bump getplumber/plumber from 0.6.1 to 0.7.0 (#722)
• 0600a42 New logo, son! (#720)
• ee75d31 Version bump to 1.13.1
• Additional commits viewable in compare view

Updates dune from 0.3.17 to 0.3.18

Changelog

Sourced from dune's changelog.

v0.3.18 (2026-10-07)

• Add a :parse_timeout option to specify the maximum time spent during parsing. Prior to this change, the parsing task might have timed out after 5000ms, the new value defaults to the same value as the :timeout option.
• Relax type of :timeout option to allow any t:timeout/0.

Commits

• b82ff4a Version 0.3.18
• 3a7dc30 Bump dev dependencies
• e3195ae Introduce a parse_timeout option (#5)
• 30f0325 Bump Elixir in CI
• d03bf9e Fix dialyzer improper_lists warning
• See full diff in compare view

Updates ex_check from 0.16.0 to 0.17.1

Updates igniter from 0.8.4 to 0.8.5

Release notes

Sourced from igniter's releases.

v0.8.5

Bug Fixes:

• add nil to Igniter.Project.Deps.get_dep/2 spec (#410) by Łukasz Samson

• insert child right after the last after: match in add_new_child/3 (#407) by Peter Shoukry

• ensure notices are printed on upgrades by Zach Daniel

Improvements:

• only fetch deps before tasks when mix.exs changed (#412) by andyl

• update Igniter.Code.Pattern for recent ExAST (#408) by Danila Poyarkov

Changelog

Sourced from igniter's changelog.

v0.8.5 (2026-10-25)

Bug Fixes:

• add nil to Igniter.Project.Deps.get_dep/2 spec (#410) by Łukasz Samson

• insert child right after the last after: match in add_new_child/3 (#407) by Peter Shoukry

• ensure notices are printed on upgrades by Zach Daniel

Improvements:

• only fetch deps before tasks when mix.exs changed (#412) by andyl

• update Igniter.Code.Pattern for recent ExAST (#408) by Danila Poyarkov

Commits

• 0289d90 chore: release version v0.8.5
• 0a9e06f chore: update decimal to clear EEF-CVE-2026-97853 advisory
• 40a646e improvement: only fetch deps before tasks when mix.exs changed (#412)
• 2d5f505 fix: add nil to Igniter.Project.Deps.get_dep/2 spec (#410)
• 4936944 docs: document igniter.init_library for library authors (#409)
• 1ff8844 improvement: update Igniter.Code.Pattern for recent ExAST (#408)
• f336dee ci: drop 1.16.3/OTP 26 matrix leg
• f638ce7 fix: insert child right after the last after: match in add_new_child/3 (#407)
• b9454fe chore: deps
• 28f2d46 build(deps): bump the all-dependencies group with 7 updates (#405)
• Additional commits viewable in compare view

Updates mimic from 2.4.1 to 2.4.2

Release notes

Sourced from mimic's releases.

Mimic 2.4.2

What's Changed

• Upgrade elixir & erlang by @​PragTob in edgurgel/mimic#126
• fix: release global mode synchronously by @​edgurgel in edgurgel/mimic#127

Full Changelog: edgurgel/mimic@v2.4.1...v2.4.2

Changelog

Sourced from mimic's changelog.

2.4.2 (2026-09-18)

• fix: release global mode when the test that set it finishes. It was handed back asynchronously with nothing waiting on it, so under load a later test could find a finished test's pid still holding it and fail with "Expect cannot be called by the current process. Only the global owner is allowed."
• breaking: set_mimic_global/1 now raises when called outside a test process. Global mode is released by an on_exit callback, which only the test process can register, so such a call took a mode that was never handed back and left the rest of the suite stuck in global mode. Call it from the test process (or a setup block) instead.

Commits

• de4a615 chore: bump 2.4.2
• d4b14ad fix: release global mode synchronously
• a206fc7 chore: upgrade elixir & erlang (#126)
• See full diff in compare view

Updates quiver from 0.4.1 to 0.4.2

Release notes

Sourced from quiver's releases.

v0.4.2

0.4.2 (2026-09-25)

Bug Fixes

• deps: Updated quic to 2.0 (94b244f)

Changelog

Sourced from quiver's changelog.

0.4.2 (2026-09-25)

Bug Fixes

• deps: Updated quic to 2.0 (94b244f)

Commits

• aed62af chore(main): release 0.4.2 (#10)
• 94b244f fix(deps): Updated quic to 2.0
• See full diff in compare view

Updates recode from 0.8.0 to 0.9.0

Changelog

Sourced from recode's changelog.

0.9.0 - 2026/10/26

• Change sorting in the AliasOrder task
• Require Elixir 1.15

Commits

• See full diff in compare view

Updates spark from 2.7.2 to 2.7.9

Release notes

Sourced from spark's releases.

v2.7.9

Bug Fixes:

• collect verifier output from compiler-built DSL modules by Emad Shaaban

• raise the options-list error for non-keyword entity opts by Leon Qadirie

Performance Improvements:

• delegate the generated section macro body to a shared function by Leon Qadirie

• precompute entity keys once per entity module by Leon Qadirie

• wrap extension sections and dsl patches in opaque by Leon Qadirie

• delegate generated DSL macro bodies to shared functions by Leon Qadirie

v2.7.8

Performance Improvements:

• don't generate error messages we'll never display by Zach Daniel

v2.7.7

Improvements:

• give auto identifiers a value the next compilation agrees on by Thomas Anagrius

Bug Fixes:

• don't call to_string on a tuple, improving compile times by Zach Daniel

v2.7.6

Improvements:

... (truncated)

Changelog

Sourced from spark's changelog.

v2.7.9 (2026-10-25)

Bug Fixes:

• collect verifier output from compiler-built DSL modules by Emad Shaaban

• raise the options-list error for non-keyword entity opts by Leon Qadirie

Performance Improvements:

• delegate the generated section macro body to a shared function by Leon Qadirie

• precompute entity keys once per entity module by Leon Qadirie

• wrap extension sections and dsl patches in opaque by Leon Qadirie

• delegate generated DSL macro bodies to shared functions by Leon Qadirie

v2.7.8 (2026-10-16)

Performance Improvements:

• don't generate error messages we'll never display by Zach Daniel

v2.7.7 (2026-10-16)

Improvements:

• give auto identifiers a value the next compilation agrees on by Thomas Anagrius

Bug Fixes:

• don't call to_string on a tuple, improving compile times by Zach Daniel

v2.7.6 (2026-10-04)

Improvements:

... (truncated)

Commits

• e9e21a9 chore: release version v2.7.9
• 8f223a7 chore: skip sobelow's code execution finding for after_define
• fe3c968 refactor: share ExDoc js file reader in spark.cheat_sheets_in_search
• 2f03f6c refactor: generate defbuilder and defbuilderp from one function
• dcf48df test: cover defbuilder and defbuilderp
• 187498d refactor: share call chain fallback in ElixirSense plugin suggestions
• c01c463 refactor: move cast_schema into Spark.Builder.Field
• 15ee25c refactor: share lifted capture definition in CodeHelpers.lift_functions
• a5d7bd9 refactor: share entity arg builder arities in formatter
• f760dea refactor: share patched entity lookup in formatter
• Additional commits viewable in compare view

Updates sycophant from 0.5.1 to 0.8.0

Release notes

Sourced from sycophant's releases.

sycophant: v0.8.0

0.8.0 (2026-10-19)

Features

• auth: add request_constraints callback applied by the pipeline (99781d9)
• enable prompt caching for OpenAI, Anthropic and OpenRouter wires (3f031e7)
• error: add SubscriptionError for ChatGPT plan failures (c0b697a)
• oauth: add Assent, OAuth credential and session structs, and HTTP adapter (4b57616)
• oauth: add generic authorization code, exchange, refresh, and revoke functions (75ce7f6)
• openai: accept ChatGPT access tokens as an openai credential mode (35afdc6)
• openai: add Sign in with ChatGPT preset, model listing, and guide (5c8c336)

Bug Fixes

• address branch review findings for ChatGPT subscription (925e6e7)
• openai: decode ChatGPT plan streams without content-type or final output (f19085c)
• usage: count cached tokens in input_tokens and bill them once (fb9903d)
• usage: count reasoning in output_tokens and bill it once (a366df7)
• usage: Fixed cache calculation (22b29a1)

sycophant: v0.7.0

0.7.0 (2026-10-13)

Features

• Added support to OpenAI Decisions API (035c7e8)

Bug Fixes

• preserve streaming errors and reasoning summaries (b09b4d3)

sycophant: v0.6.0

0.6.0 (2026-09-25)

Features

• evaluation: add EvaluationAnswer and EvaluationResponse structs (32187c7)
• evaluation: add EvaluationRequest with question validation (d7ea943)
• evaluation: add EvaluationWireProtocol and TypeSafe System One adapter (4b17c91)
• evaluation: add Sycophant.evaluate/4 and the evaluation pipeline (b1ccb3d)
• evaluation: resolve evaluation models and reject chat calls on non-chat models (a9e370b)
• openrouter: add Decisions adapter for evaluation models (c682e86)
• otel: translate evaluation telemetry into OpenTelemetry spans (4d6904b)
• provider: Added support to WanDB (0639ec6)

Changelog

Sourced from sycophant's changelog.

0.8.0 (2026-10-19)

Features

• auth: add request_constraints callback applied by the pipeline (99781d9)
• enable prompt caching for OpenAI, Anthropic and OpenRouter wires (3f031e7)
• error: add SubscriptionError for ChatGPT plan failures (c0b697a)
• oauth: add Assent, OAuth credential and session structs, and HTTP adapter (4b57616)
• oauth: add generic authorization code, exchange, refresh, and revoke functions (75ce7f6)
• openai: accept ChatGPT access tokens as an openai credential mode (35afdc6)
• openai: add Sign in with ChatGPT preset, model listing, and guide (5c8c336)

Bug Fixes

• address branch review findings for ChatGPT subscription (925e6e7)
• openai: decode ChatGPT plan streams without content-type or final output (f19085c)
• usage: count cached tokens in input_tokens and bill them once (fb9903d)
• usage: count reasoning in output_tokens and bill it once (a366df7)
• usage: Fixed cache calculation (22b29a1)

0.7.0 (2026-10-13)

Features

• Added support to OpenAI Decisions API (035c7e8)

Bug Fixes

• preserve streaming errors and reasoning summaries (b09b4d3)

0.6.0 (2026-09-25)

Features

• evaluation: add EvaluationAnswer and EvaluationResponse structs (32187c7)
• evaluation: add EvaluationRequest with question validation (d7ea943)
• evaluation: add EvaluationWireProtocol and TypeSafe System One adapter (4b17c91)
• evaluation: add Sycophant.evaluate/4 and the evaluation pipeline (b1ccb3d)
• evaluation: resolve evaluation models and reject chat calls on non-chat models (a9e370b)
• openrouter: add Decisions adapter for evaluation models (c682e86)
• otel: translate evaluation telemetry into OpenTelemetry spans (4d6904b)
• provider: Added support to WanDB (0639ec6)

Commits

• 7350794 chore(main): release sycophant 0.8.0 (#16)
• 082841e chore: Updated deps for CVE fix
• a366df7 fix(usage): count reasoning in output_tokens and bill it once
• fb9903d fix(usage): count cached tokens in input_tokens and bill them once
• 3f031e7 feat: enable prompt caching for OpenAI, Anthropic and OpenRouter wires
• 22b29a1 fix(usage): Fixed cache calculation
• f19085c fix(openai): decode ChatGPT plan streams without content-type or final output
• 925e6e7 fix: address branch review findings for ChatGPT subscription
• 5c8c336 feat(openai): add Sign in with ChatGPT preset, model listing, and guide
• 75ce7f6 feat(oauth): add generic authorization code, exchange, refresh, and revoke fu...
• Additional commits viewable in compare view

Updates tidewave from 0.9.0 to 0.9.2

Changelog

Sourced from tidewave's changelog.

v0.9.2 (2026-10-27)

• Avoid DNS rebinding attacks on /tidewave/connect route (CVE-2026-109823)

v0.9.1 (2026-09-23)

• Add mix tidewave.proxy
• Add "instructions" to MCP initialization response

Commits

• bf1f223 Release v0.9.2
• 64056ef write connect CI guide for codex and claude (#277)
• 8015953 Improve host checks (#278)
• edae12e Add more disclaimers around remote access
• 6c323fb Update editor docs
• 7134830 Clean up remote access guide
• bd113df Update docs
• e92e13a Release v0.9.1
• 6107915 Add MCP instructions
• 82fe4d2 Add doctype to tidewave html endpoints
• Additional commits viewable in compare view

Updates usage_rules from 1.2.8 to 1.3.0

Release notes

Sourced from usage_rules's releases.

v1.3.0

What's Changed

• feat: add mix usage_rules.validate for reference validation by @​lukegalea in ash-project/usage_rules#88
• chore(deps): bump the all-dependencies group with 5 updates by @​dependabot[bot] in ash-project/usage_rules#89
• fix: raise a clear error when a validate argument matches no files by @​lukegalea in ash-project/usage_rules#90

New Contributors

• @​lukegalea made their first contribution in ash-project/usage_rules#88

Full Changelog: ash-project/usage_rules@v1.2.8...v1.3.0

Changelog

Sourced from usage_rules's changelog.

v1.3.0 (2026-10-25)

Features:

• add mix usage_rules.validate for reference validation (#88) by Luke Galea

Bug Fixes:

• raise a clear error when a validate argument matches no files (#90) by Luke Galea

Commits

• 83c7486 chore: release version v1.3.0
• 67c3f52 fix: raise a clear error when a validate argument matches no files (#90)
• 225d579 chore(deps): bump the all-dependencies group with 5 updates (#89)
• 89c61ee feat: add mix usage_rules.validate for reference validation (#88)
• a02f23d chore: reference CVE-2026-82710 in changelog
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions