Skip to content

Bump the production-dependencies group across 1 directory with 11 updates#216

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/hex/production-dependencies-55be7ffd02
Open

Bump the production-dependencies group across 1 directory with 11 updates#216
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/hex/production-dependencies-55be7ffd02

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 9 updates in the / directory:

Package From To
bandit 1.10.4 1.11.1
ecto_sql 3.13.5 3.14.0
finch 0.21.0 0.22.0
phoenix 1.8.5 1.8.8
phoenix_live_view 1.1.28 1.2.1
req 0.5.17 0.6.1
swoosh 1.25.0 1.26.1
tailwind 0.4.1 0.5.0
thousand_island 1.4.3 1.5.0

Updates bandit from 1.10.4 to 1.11.1

Changelog

Sourced from bandit's changelog.

1.11.1 (13 May 2026)

Fixes

Changes

  • We no longer disallow . and .. path components in HTTP/2 absolute paths (#581)

1.11.0 (1 May 2026)

Fixes

Enhancements

  • Define a new max_inflate_ratio WebSocket configuration option that defines a maximum allowable decompression ratio to help mitigate inflate bombing. Defaults to 25:1
  • Define a new max_fragmented_message_size WebSocket configuration option which defines the maximum allowed WebSocket frame size (inclusive of continuation frames). Defaults to 8MB

Changes

  • The default value of the max_frame_size WebSocket option has changed from :infinity to 8MB
  • Zero length non-fin continuation frames are now disallowed (we now skip Autobahn 6.1.2 as a result)
  • Multiple content-length fields in an HTTP/1 request are now disallowed (CVE-2026-39805, commit f2ca636, thanks @​PJUllrich & @​maennchen!)
  • We now only use the underlying transport when determining scheme (CVE-2026-39807, commit 45feea2, thanks @​PJUllrich & @​maennchen!)
Commits

Updates ecto_sql from 3.13.5 to 3.14.0

Changelog

Sourced from ecto_sql's changelog.

v3.14.0 (2026-05-19)

Enhancements

  • [migrations] Allow table modifiers such as UNLOGGED tables
  • [migrations] Add Safe Ecto Migration guides
  • [mysql] Support insert_mode: :ignore
  • [postgres] Set a default timezone on mix ecto.create
  • [sandbox] Label the sandbox owner process
  • [sql] Allow fragment tuple sources in adapters
  • [sql] Allow pid repos in Ecto.Adapters.SQL.table_exists?
  • [sql] Accept counter option in to_sql/4
  • [sql] Support {:unsafe_fragment, ...} support to RETURNING clause
Commits

Updates finch from 0.21.0 to 0.22.0

Changelog

Sourced from finch's changelog.

v0.22.0 (2026-05-12)

Added

  • Add a new :http2 configuration section with :wait_for_server_settings?, :ping_interval, :max_connection_age, and :max_connection_age_jitter support #354 #355 #364
  • Add http+unix:// and https+unix:// URL scheme support for cleaner Unix socket pool configuration #351
  • Add pool tagging support for connection pool isolation #342
  • Add dynamic and user-managed pool APIs with Finch.start_pool/3, Finch.find_pool/2, and Finch.Pool.child_spec/1 #352
  • Add Finch.is_request_ref/1 for matching async request refs in guards #350
  • Add configurable pool worker selection strategies via :pool_strategy #359
  • Add runtime pool resizing with Finch.get_pool_count/2 and Finch.set_pool_count/3 #362
  • Add pid, max_concurrent_streams, and available_connections to pool metrics #362 #368
  • Support {:stream, req_body_fun} request bodies in Finch.stream_while/5 on HTTP/1 #357 #360
  • Encapsulate pool identity using a Finch.Pool struct #338
  • Add Elixir 1.20 support #346

Changed

  • Require Elixir v1.15 #358
  • Refactor pool management to use per-pool supervisors and registry-backed tracking #344
  • Pool metrics now return Finch.Pool.t() structs as keys and use ordered-set ETS tables for prefix lookups #342 #368
  • Register only ready HTTP/2 connections, returning :pool_not_available when no connected pool is available #356
  • Standardize error handling with Finch.error(), Finch.HTTPError, and Finch.TransportError #341
  • Validate keyword options in Finch.build/5 and Finch.request/3 #365
  • Use Mint 1.8 #341

Deprecated

  • Deprecate {scheme, {:local, path}} tuple form in :pools, use URL strings (e.g. "http+unix:///path") instead #351

Removed

  • Remove deprecated Finch.request/6 function, pool configuration options, and :max_idle_time_exceeded telemetry event #348

Fixed

  • Do not exceed max failure count to stop overflows #343
  • Clean up pool metrics when pools terminate or resize #362
  • Prevent atom creation for non-existent Finch instances #342
  • Make flaky CI assertions more reliable #340
  • Prevent HTTP/1 pools from being considered idle immediately after fresh checkouts #372

Other

  • Improve documentation around pool :count, :size, and strategies #361
  • Document Finch.build/5 options #347
  • CI: update the Elixir 1.20 release candidate to 1.20.0-rc.4
Commits

Updates jason from 1.4.4 to 1.4.5

Changelog

Sourced from jason's changelog.

1.4.5 (05.05.2026)

  • Add support for Decimal 3.0
Commits
  • 4ede428 Bump v1.4.5
  • b8c2185 Fix dialyzer job
  • a363975 Modernise CI to currently supported versions
  • 243c8a8 Allow decimal 3.0
  • c8e8d05 Revert the experimental 1.5 branch and jason_native experiment
  • 0e7a3e2 Add example/doctest for Jason.OrderedObject.new/1
  • 984bc07 fix broken link
  • f775592 Raise if trying to decode decimals without decimal
  • 79d59df Remove unneeded workarounds for xref warnings
  • baac78e Fix warnings by conditionally compiling Decimal support
  • Additional commits viewable in compare view

Updates phoenix from 1.8.5 to 1.8.8

Changelog

Sourced from phoenix's changelog.

1.8.8 (2026-06-10)

Enhancements

  • [phx.new] Use LiveView 1.2.0

1.8.7 (2026-05-06)

Bug fixes

  • Fix invalid status when longpoll request times out

Enhancements

  • Mask token parameter in logs by default (in addition to "password")

JavaScript Client Bug Fixes

  • Fix encoding of non-ASCII metadata in binary channel messages

1.8.6 (2026-05-05)

Security fixes

  • CVE-2026-32689: Fix Phoenix.Socket Longpoll transport memory exhaustion in nd-JSON body splitting

Enhancements

  • [phoenix] Raise if use Phoenix.VerifiedRoutes is called multiple times in the same module
  • [phoenix] Fix more deprecation and type checker warnings on Elixir 1.20
  • [phoenix] Raise when interpolating a list in Phoenix.VerifiedRoutes (#6632)
  • [phoenix] Gracefully handle non-binary vsn socket parameter (#6662)
  • [phx.gen.*] Use .eex filename suffix in generator files
  • [phx.new] Add interactive mode: mix phx.new --interactive (#6630)
  • [phx.new] Add phx-no-format to generated <.live_title> tag (#6667)

Bug fixes

  • [phx.gen.*] Fix generated migrations for myxql when using scopes (#6635)
  • [phx.new] Fix crash when parent directory contains a colon (#6633)
Commits
  • 99df0a9 Release v1.8.8
  • 729f781 Generator changes for LiveView 1.2 (#6696)
  • d453e37 Use Elixir's builtin consolidation from v1.19, closes #4951
  • f30fa36 Clarify channel payloads can be any serializable value (#6695)
  • e1e7912 Replace all hexdocs URLs with the subdomain format (#6693)
  • cf9dd26 Add README template for Phoenix umbrella (#6691)
  • 39eb5dd Refactor template override backward compatibility test (#6684)
  • e1c3816 chore: small typo fix in controllers.md (#6689)
  • b6a4e31 Make websocket disconnect codes explicit (#6678)
  • eea4895 Add eex suffix to phx.gen.auth template override test (#6680)
  • Additional commits viewable in compare view

Updates phoenix_live_view from 1.1.28 to 1.2.1

Release notes

Sourced from phoenix_live_view's releases.

v1.2.1

Bug fixes

  • Fix stale events from the previous LiveView being sent to the new LiveView after a live redirect (#4291)

v1.2.0

Enhancements

  • Support events pushed when connected mount redirects (#4269)

Bug fixes

  • Ensure for comprehensions in HEEx use deterministic variables
  • Ensure connect_params are kept when following redirects in LiveViewTest (#4005)
  • Ensure exceptions during LiveComponent renders are emitted as :telemetry event (#4258)
  • Fix whitespace handling of EEx nodes in HEEx compiler (#4277)

v1.2.0-rc.3

Enhancements

Bug fixes

  • Fix nested assign change tracking (#4225)
  • Ensure Phoenix.LiveViewTest.live_redirect/2 properly passes the URI as a string in handle_params (#4247)

v1.2.0-rc.2

Bug fixes

  • Ensure internal phx-viewport hook does not crash on update if no scroll container is used (#4214)

v1.2.0-rc.1

Enhancements

  • Align Phoenix.Component global attributes list with reference list from MDN (#4207). If you relied on one of the removed attributes, use the include option instead. For example: 
    attr :rest, :global, include: ~w(width height)
  • Allow setting id attributes clientside for accessibility with this.js().setAttribute() (#4146)
  • Export getFileURLForUpload helper (#4206)
  • Use moveBefore if available when reordering stream items (#4212)

Bug fixes

... (truncated)

Changelog

Sourced from phoenix_live_view's changelog.

v1.2.1 (2026-06-11)

Bug fixes

  • Fix stale events from the previous LiveView being sent to the new LiveView after a live redirect (#4291)

v1.2.0 (2026-06-10) 🚀

Enhancements

  • Support events pushed when connected mount redirects (#4269)

Bug fixes

  • Ensure for comprehensions in HEEx use deterministic variables
  • Ensure connect_params are kept when following redirects in LiveViewTest (#4005)
  • Ensure exceptions during LiveComponent renders are emitted as :telemetry event (#4258)
  • Fix whitespace handling of EEx nodes in HEEx compiler (#4277)

v1.2.0-rc.3 (2026-05-29)

Enhancements

Bug fixes

  • Fix nested assign change tracking (#4225)
  • Ensure Phoenix.LiveViewTest.live_redirect/2 properly passes the URI as a string in handle_params (#4247)

v1.2.0-rc.2 (2026-05-05)

Bug fixes

  • Ensure internal phx-viewport hook does not crash on update if no scroll container is used (#4214)

v1.2.0-rc.1 (2026-05-04)

Enhancements

  • Align Phoenix.Component global attributes list with reference list from MDN (#4207). If you relied on one of the removed attributes, use the include option instead. For example: 
    attr :rest, :global, include: ~w(width height)
  • Allow setting id attributes clientside for accessibility with this.js().setAttribute() (#4146)
  • Export getFileURLForUpload helper (#4206)
  • Use moveBefore if available when reordering stream items (#4212)

Bug fixes

... (truncated)

Commits
  • f0da401 Release v1.2.1
  • 1a83ece Update assets
  • e38e6fb When navigating, prevent outdated events from reaching the new view (#4291)
  • 92c9d8d Improve security guide regarding user input (#4285)
  • c543641 Use elixirc_options: [no_warn_undefined: ...] instead of xref: [exclude: ...]...
  • 189f22a Replace internal docs references .html -> .md (#4286)
  • cdfff45 Add security notes for mount, handle_params, and handle_event (#4284)
  • f2759d3 Fix missing parenthesis in Security Model example (#4283)
  • 923e859 Release v1.2.0
  • 0f57334 ensure connect_params are kept when following redirects (#4249)
  • Additional commits viewable in compare view

Updates postgrex from 0.22.0 to 0.22.2

Changelog

Sourced from postgrex's changelog.

v0.22.2 (2026-05-12)

  • Security
    • Escape quotes in channel names in Postgrex.Notifications.listen/3 (CVE-2026-32687)

v0.22.1 (2026-03-05)

  • Enhancements

    • Relax decimal requirement
    • Set process labels in Postgrex processes

  • Bug fixes

    • Return proper error when getting tcp closed after fatal errors
Commits

Updates req from 0.5.17 to 0.6.1

Release notes

Sourced from req's releases.

v0.6.1

v0.6.0

  • encode_body: Security fix for :form_multipart header injection (GHSA-px9f-whj3-246m).

    The multipart encoder interpolated the per-part name, filename, and content_type into the part headers without escaping, so an attacker-controlled value could inject extra headers or smuggle additional parts into the request. These values are now escaped per RFC 7578 / WHATWG form-data (", CR, and LF are percent-encoded).

    Thanks to @​PJUllrich for reporting it.

  • decode_body: Drop automatic zip/tar/tgz/gz/zst/csv decoding, (GHSA-655f-mp8p-96gv).

    Req previously auto-decoded archive and compressed response bodies (zip, tar, tgz, gz, zst, and csv) based on the server-supplied content-type, materialising the full decompressed contents in memory with no size cap. An attacker-controlled (or redirect-reachable) endpoint could return a tiny "decompression bomb" that expanded to gigabytes and exhausted the node's memory.

    Now only JSON is decoded by default. Other formats are opt-in via the new :decoders option, which defaults to [:json, :json_api]. Setting it replaces the default (include :json to keep JSON decoding), and false disables all decoding:

    # opt into archives (only for endpoints you trust):
Req.get!(url, decoders: [:json, :zip])

    Note: The decoded zip/tar is still list of {filename :: charlist(), contents :: binary} tuples. In the future release, this will be list of {filename :: binary(), contents :: binary()} tuples.

    While automatic CSV decoding wasn't a security issue, the behaviour based on presence/absence of nimble_csv dependency was suprising. CSV support is still built-in but need to be enabled with decoders: [:csv].

... (truncated)

Changelog

Sourced from req's changelog.

v0.6.1 (2026-06-08)

  • [compressed], [decompress_body]: Disable automatic decompression

    Decompression is now opt-in by setting compressed: true.

v0.6.0 (2026-06-08)

  • [encode_body]: Security fix for :form_multipart header injection (GHSA-px9f-whj3-246m).

    The multipart encoder interpolated the per-part name, filename, and content_type into the part headers without escaping, so an attacker-controlled value could inject extra headers or smuggle additional parts into the request. These values are now escaped per RFC 7578 / WHATWG form-data (", CR, and LF are percent-encoded).

    Thanks to @​PJUllrich for reporting it.

  • [decode_body]: Drop automatic zip/tar/tgz/gz/zst/csv decoding, (GHSA-655f-mp8p-96gv).

    Req previously auto-decoded archive and compressed response bodies (zip, tar, tgz, gz, zst, and csv) based on the server-supplied content-type, materialising the full decompressed contents in memory with no size cap. An attacker-controlled (or redirect-reachable) endpoint could return a tiny "decompression bomb" that expanded to gigabytes and exhausted the node's memory.

    Now only JSON is decoded by default. Other formats are opt-in via the new :decoders option, which defaults to [:json, :json_api]. Setting it replaces the default (include :json to keep JSON decoding), and false disables all decoding:

    # opt into archives (only for endpoints you trust):
Req.get!(url, decoders: [:json, :zip])

    Note: The decoded zip/tar is still list of {filename :: charlist(), contents :: binary} tuples. In the future release, this will be list of {filename :: binary(), contents :: binary()} tuples.

    While automatic CSV decoding wasn't a security issue, the behaviour based on presence/absence of nimble_csv dependency was suprising. CSV support is still built-in but need to be enabled with decoders: [:csv].

    Custom decoders are supported via {format, codec} tuples, where codec is a module exporting decode/1 or a 1-arity function returning an :ok/:error tuple, for example:

... (truncated)

Commits
  • 36a8252 Release v0.6.1
  • ea5506f compressed, decompress_body: Disable automatic decompression
  • 8e7425f Release v0.6.0
  • 584a490 decode_body: Drop automatic zip/tar/tgz/gz/zst/csv decoding
  • 2d77dbe encode_body: Security fix for :form_multipart header injection
  • 53c3b99 Release v0.5.18
  • dc1f3be Update ex_doc
  • dbd145c Update CHANGELOG.md
  • 75f077e retry: Automatically retry on :pool_not_available
  • 4cfbf54 run_finch: Normalize Finch.TransportError,HTTPError (Finch 0.22+) (#544)
  • Additional commits viewable in compare view

Updates swoosh from 1.25.0 to 1.26.1

Release notes

Sourced from swoosh's releases.

v1.26.1 🚀

🐛 Bug Fixes

  • fix fat-fingering content_id instead of cid, added tests, fixed outdated expected response in mua_test.exs @​waseigo (#1155)

🧰 Maintenance

v1.26.0 🚀

✨ Features

⛓️ Dependency

New Contributors

Full Changelog: swoosh/swoosh@1.25.3...v1.26.0

v1.25.3 🚀

📝 Documentation

🧰 Maintenance

New Contributors

Full Changelog: swoosh/swoosh@v1.25.2...1.25.3

v1.25.2 🚀

🐛 Bug Fixes

... (truncated)

Changelog

Sourced from swoosh's changelog.

1.26.1

🐛 Bug Fixes

1.26.0

✨ Features

📝 Documentation

  • Document the new Mailpit adapter in the README

1.25.3

📝 Documentation

🧰 Maintenance

1.25.2

🐛 Bug Fixes

1.25.1

🐛 Bug Fixes

Commits

Updates tailwind from 0.4.1 to 0.5.0

Changelog

Sourced from tailwind's changelog.

v0.5.0 (Unreleased)

  • Allow configuring :version per profile
  • Allow env values to be lists, joined by the OS path separator
Commits

Updates thousand_island from 1.4.3 to 1.5.0

Changelog

Sourced from thousand_island's changelog.

1.5.0 (1 Jun 2026)

Changes

  • Not-strictly-breaking-but-still-important-change: We've improved the isolation between network-related timeouts and GenServer-related timeouts. Specifically, local GenServer callbacks (handle_info et al) no longer affect network-related timeouts; a 30s network timeout will be enforced after 30 seconds, regardless of how many local messages arrive in the process' mailbox. See #202 for more details.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the production-dependencies group across 1 directory with 11 upd…
3e65b3f 
…ates

Bumps the production-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [bandit](https://github.com/mtrudel/bandit) | `1.10.4` | `1.11.1` |
| [ecto_sql](https://github.com/elixir-ecto/ecto_sql) | `3.13.5` | `3.14.0` |
| [finch](https://github.com/sneako/finch) | `0.21.0` | `0.22.0` |
| [phoenix](https://github.com/phoenixframework/phoenix) | `1.8.5` | `1.8.8` |
| [phoenix_live_view](https://github.com/phoenixframework/phoenix_live_view) | `1.1.28` | `1.2.1` |
| [req](https://github.com/wojtekmach/req) | `0.5.17` | `0.6.1` |
| [swoosh](https://github.com/swoosh/swoosh) | `1.25.0` | `1.26.1` |
| [tailwind](https://github.com/phoenixframework/tailwind) | `0.4.1` | `0.5.0` |
| [thousand_island](https://github.com/mtrudel/thousand_island) | `1.4.3` | `1.5.0` |



Updates `bandit` from 1.10.4 to 1.11.1
- [Changelog](https://github.com/mtrudel/bandit/blob/main/CHANGELOG.md)
- [Commits](mtrudel/bandit@1.10.4...1.11.1)

Updates `ecto_sql` from 3.13.5 to 3.14.0
- [Changelog](https://github.com/elixir-ecto/ecto_sql/blob/master/CHANGELOG.md)
- [Commits](elixir-ecto/ecto_sql@v3.13.5...v3.14.0)

Updates `finch` from 0.21.0 to 0.22.0
- [Changelog](https://github.com/sneako/finch/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sneako/finch/commits)

Updates `jason` from 1.4.4 to 1.4.5
- [Release notes](https://github.com/michalmuskala/jason/releases)
- [Changelog](https://github.com/michalmuskala/jason/blob/master/CHANGELOG.md)
- [Commits](michalmuskala/jason@v1.4.4...v1.4.5)

Updates `phoenix` from 1.8.5 to 1.8.8
- [Release notes](https://github.com/phoenixframework/phoenix/releases)
- [Changelog](https://github.com/phoenixframework/phoenix/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/phoenix@v1.8.5...v1.8.8)

Updates `phoenix_live_view` from 1.1.28 to 1.2.1
- [Release notes](https://github.com/phoenixframework/phoenix_live_view/releases)
- [Changelog](https://github.com/phoenixframework/phoenix_live_view/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/phoenix_live_view@v1.1.28...v1.2.1)

Updates `postgrex` from 0.22.0 to 0.22.2
- [Release notes](https://github.com/elixir-ecto/postgrex/releases)
- [Changelog](https://github.com/elixir-ecto/postgrex/blob/master/CHANGELOG.md)
- [Commits](elixir-ecto/postgrex@v0.22.0...v0.22.2)

Updates `req` from 0.5.17 to 0.6.1
- [Release notes](https://github.com/wojtekmach/req/releases)
- [Changelog](https://github.com/wojtekmach/req/blob/main/CHANGELOG.md)
- [Commits](wojtekmach/req@v0.5.17...v0.6.1)

Updates `swoosh` from 1.25.0 to 1.26.1
- [Release notes](https://github.com/swoosh/swoosh/releases)
- [Changelog](https://github.com/swoosh/swoosh/blob/main/CHANGELOG.md)
- [Commits](swoosh/swoosh@v1.25.0...v1.26.1)

Updates `tailwind` from 0.4.1 to 0.5.0
- [Changelog](https://github.com/phoenixframework/tailwind/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/tailwind@v0.4.1...v0.5.0)

Updates `thousand_island` from 1.4.3 to 1.5.0
- [Changelog](https://github.com/mtrudel/thousand_island/blob/main/CHANGELOG.md)
- [Commits](mtrudel/thousand_island@1.4.3...1.5.0)

---
updated-dependencies:
- dependency-name: bandit
  dependency-version: 1.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: ecto_sql
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: finch
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: jason
  dependency-version: 1.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: phoenix
  dependency-version: 1.8.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: phoenix_live_view
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: postgrex
  dependency-version: 0.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: req
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: swoosh
  dependency-version: 1.26.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tailwind
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: thousand_island
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code labels Jun 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants