Skip to content

Bump tesla from 1.17.0 to 1.20.0 - #268

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/tesla-1.20.0
Closed

Bump tesla from 1.17.0 to 1.20.0#268
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/tesla-1.20.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026

Copy link
Copy Markdown
Contributor

Bumps tesla from 1.17.0 to 1.20.0.

Release notes

Sourced from tesla's releases.

v1.20.0

1.20.0 (2026-06-05)

Features

  • support {:form,data} tagged body tuples (#886) (b1b3b80)

v1.19.0

1.19.0 (2026-06-04)

Features

  • finch-adapter: Finch adapter will pass through all supported options (#879) (7609328)
  • form-urlencoded: support nested bodies via :brackets option (#878) (f7142e8)

v1.18.3

1.18.3 (2026-06-02)

Important {: .error}

Please be careful using :hackney it is recommended to actually test the application before assuming we did not introduce any breaking changes. Also, be aware of the security vulnerabilities we have fixed in this release. Some of them may cause some unexpected behavior from the middleware depending on the assumptions made by the caller.

Features

Security CVE

  • CVE-2026-48598 - Multipart part smuggling via unescaped content-disposition values
  • CVE-2026-48597 - Atom exhaustion via untrusted URL scheme
  • CVE-2026-48596 - CRLF injection in request Content-Type header via add_content_type_param
  • CVE-2026-48595 - Authorization header leaks on cross-origin redirect via case-sensitive filtering
  • CVE-2026-48594 - Decompression bomb on response body

v1.18.2

1.18.2 (2026-05-15)

Bug Fixes

  • builder: include :assigns and :private in request option type (#876) (f5834c1)

v1.18.1

1.18.1 (2026-05-14)

... (truncated)

Changelog

Sourced from tesla's changelog.

1.20.0 (2026-06-05)

Features

  • support {:form,data} tagged body tuples (#886) (b1b3b80)

1.19.0 (2026-06-04)

Features

  • finch-adapter: Finch adapter will pass through all supported options (#879) (7609328)
  • form-urlencoded: support nested bodies via :brackets option (#878) (f7142e8)

1.18.3 (2026-06-02)

Important {: .error}

Please be careful using :hackney it is recommended to actually test the application before assuming we did not introduce any breaking changes. Also, be aware of the security vulnerabilities we have fixed in this release. Some of them may cause some unexpected behavior from the middleware depending on the assumptions made by the caller.

Features

Security CVE

  • CVE-2026-48598 - Multipart part smuggling via unescaped content-disposition values
  • CVE-2026-48597 - Atom exhaustion via untrusted URL scheme
  • CVE-2026-48596 - CRLF injection in request Content-Type header via add_content_type_param
  • CVE-2026-48595 - Authorization header leaks on cross-origin redirect via case-sensitive filtering
  • CVE-2026-48594 - Decompression bomb on response body

1.18.2 (2026-05-15)

Bug Fixes

  • builder: include :assigns and :private in request option type (#876) (f5834c1)

1.18.1 (2026-05-14)

Bug Fixes

  • path-params: raise on missing required path parameter values (#874) (a1dd44b)

... (truncated)

Commits
  • 901ce60 chore(master): release 1.20.0 (#887)
  • b1b3b80 feat: support {:form,data} tagged body tuples (#886)
  • 603ea34 chore(master): release 1.19.0 (#885)
  • 7609328 feat(finch-adapter): Finch adapter will pass through all supported options (#...
  • f7142e8 feat(form-urlencoded): support nested bodies via :brackets option (#878)
  • 2d3c800 chore(ci): bump release workflow to Elixir 1.19 / OTP 28 (#884)
  • 2eb7a78 chore(master): release 1.18.3 (#883)
  • 3a369b8 chore: release 1.18.3
  • 340f75b Merge commit from fork
  • db963db Merge commit from fork
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [tesla](https://github.com/elixir-tesla/tesla) from 1.17.0 to 1.20.0.
- [Release notes](https://github.com/elixir-tesla/tesla/releases)
- [Changelog](https://github.com/elixir-tesla/tesla/blob/master/CHANGELOG.md)
- [Commits](elixir-tesla/tesla@v1.17.0...v1.20.0)

---
updated-dependencies:
- dependency-name: tesla
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code labels Jun 15, 2026
jarlah added a commit that referenced this pull request Jul 23, 2026
* Bundle 5 dependabot dependency updates

Bumps postgrex 0.22.2 -> 0.22.3, credo 1.7.18 -> 1.7.19,
tesla 1.17.0 -> 1.20.0, mongodb_driver 1.6.2 -> 1.6.3, and
kafka_ex 0.15.0 -> 1.1.0.

kafka_ex 1.0 was a full API rewrite (legacy modules like
KafkaEx.Protocol.CreateTopics.TopicRequest and top-level functions
like KafkaEx.produce/4, KafkaEx.stream/3, KafkaEx.metadata/1 were
removed in favor of KafkaEx.API.*), which broke
test/container/kafka_container_test.exs at compile time. Migrated
the test to KafkaEx.API.create_topic/produce_one/fetch. The Kafka
container implementation itself doesn't depend on kafka_ex (it
shells out to kafka-topics.sh), so no lib/ changes were needed.

Targets kafka_ex 1.1.0 rather than the 1.0.1 the dependabot PR
proposed, since 1.1.0 (released today) fixes a stream auto-commit
data-loss bug present in 1.0.1.

Supersedes #267, #268, #269, #270, #271.

* Pin uniq to 0.6.2 to fix Elixir 1.15 CI failure

uniq 0.6.3 added lib/scoped_uuid.ex, which uses a binary pattern
construct that fails to compile on Elixir 1.15 (works fine on
1.16+). We only ever call Uniq.UUID.uuid4/0, never Uniq.ScopedUUID,
so pinning below the offending release has no functional impact.

Verified no security regression: no advisories for uniq in the OSV
or GitHub Security Advisories databases at any version, and the
only other change between 0.6.2 and 0.6.3 is a cosmetic refactor of
an internal compare/2 helper.

This was failing identically on main and on all 5 original
dependabot PRs before this change.
@jarlah jarlah closed this in #272 Jul 23, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/hex/tesla-1.20.0 branch July 23, 2026 16:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants