Skip to content

build(deps): bump the mix-production-dependencies group across 1 directory with 12 updates - #385

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/src/flagd-ui/mix-production-dependencies-d732a626df
Open

build(deps): bump the mix-production-dependencies group across 1 directory with 12 updates#385
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/src/flagd-ui/mix-production-dependencies-d732a626df

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the mix-production-dependencies group with 11 updates in the /src/flagd-ui directory:

Package From To
bandit 1.7.0 1.12.0
dns_cluster 0.1.3 0.2.0
gettext 0.26.2 1.0.2
heroicons v2.1.1 v2.2.0
jason 1.4.4 1.4.5
opentelemetry_exporter 1.8.1 1.10.0
phoenix 1.8.0 1.8.9
phoenix_live_view 1.1.3 1.2.7
req 0.5.15 0.6.3
swoosh 1.19.5 1.26.3
tailwind 0.3.1 0.5.1

Updates bandit from 1.7.0 to 1.12.0

Changelog

Sourced from bandit's changelog.

1.12.0 (5 June 2026)

Changes

Fixes

  • Properly handle mixed-case Transfer-Encoding headers (#590, thanks @​mize85!)

Enhancements

  • Internal improvements to HTTP/1 body read functions (#588)

1.11.1 (13 May 2026)

Fixes

Changes

  • We no longer disallow . and .. path components in HTTP/2 absolute paths (#581)

1.11.0 (1 May 2026)

Fixes

Enhancements

  • Define a new max_inflate_ratio WebSocket configuration option that defines a maximum allowable decompression ratio to help mitigate inflate bombing. Defaults to 25:1
  • Define a new max_fragmented_message_size WebSocket configuration option which defines the maximum allowed WebSocket frame size (inclusive of continuation frames). Defaults to 8MB

Changes

  • The default value of the max_frame_size WebSocket option has changed from :infinity to 8MB
  • Zero length non-fin continuation frames are now disallowed (we now skip Autobahn 6.1.2 as a result)
  • Multiple content-length fields in an HTTP/1 request are now disallowed (CVE-2026-39805, commit f2ca636, thanks @​PJUllrich & @​maennchen!)
  • We now only use the underlying transport when determining scheme (CVE-2026-39807, commit 45feea2, thanks @​PJUllrich & @​maennchen!)

... (truncated)

Commits

Updates dns_cluster from 0.1.3 to 0.2.0

Changelog

Sourced from dns_cluster's changelog.

0.2.0 (2025-03-04)

  • Support multiple DNS queries
Commits

Updates gettext from 0.26.2 to 1.0.2

Changelog

Sourced from gettext's changelog.

v1.0.2

  • Only skip manifest removal on Elixir v1.19.3+

v1.0.1 (retired)

  • Remove unnecessary cleaning of Elixir manifests

v1.0.0

This is the first 1.0 release of Gettext, a silly 10 years (and 6 months) after we started working on it. There are very few changes from the latest 0.26 release, and none of them are breaking.

Here are the new goodies:

  • Add support for concatenating sigils if all parts are known at compile time (such as "Hello " <> ~s(world)).
  • Significantly increase the timeout for mix gettext.extract to two minutes.
  • Add Gettext.put_locale!/2.

Happy 10+ years of Elixir translations everyone! 🎉

Previous versions

See the CHANGELOG for versions before v1.0.

Commits
  • e3180f1 Release v1.0.2
  • ec2f9c1 Erase manifest unless on upcoming Elixir (#425)
  • 4960e49 Revert "Removed unnecessary cleaning of Elixir manifests (#423)"
  • 8844a32 Trim CHANGELOG
  • 7fe2dc7 Release v1.0.1
  • 30bf87d Removed unnecessary cleaning of Elixir manifests (#423)
  • d33d745 Bump actions/checkout from 4.2.2 to 5.0.0 (#422)
  • 7443953 Use ubuntu-latest in the publish-to-hex.yml workflow
  • d1a8c86 Release v1.0.0
  • e1df334 Update Elixir/Erlang versions in CI
  • Additional commits viewable in compare view

Updates heroicons from v2.1.1 to v2.2.0

Release notes

Sourced from heroicons's releases.

v2.2.0

Added

  • Add React 19 support (#1247)

Fixed

  • Removed unnecessary clipping path from solid/arrow-left-circle (#1211)

v2.1.5

Added

  • Add new icons (arrow-turn-*, bold, calendar-date-range, divide, document-currency-*, equals, h1, h2, h3, italic, link-slash, numbered-list, percent-badge, slash, strikethrough, underline)

v2.1.4

Fixed

  • Improve tree-shakability of React package (#1192)

v2.1.3

  • Improve project READMEs (#1152)

v2.1.2

  • Include license file with published packages (#1151)
Changelog

Sourced from heroicons's changelog.

[2.2.0] - 2024-11-18

Added

  • Add React 19 support (#1247)

Fixed

  • Removed unnecessary clipping path from solid/arrow-left-circle (#1211)

[2.1.5] - 2024-07-10

Added

  • Add new icons (arrow-turn-*, bold, calendar-date-range, divide, document-currency-*, equals, h1, h2, h3, italic, link-slash, numbered-list, percent-badge, slash, strikethrough, underline)

[2.1.4] - 2024-06-17

Fixed

  • Improve tree-shakability of React package (#1192)

[2.1.3] - 2024-03-22

  • Improve project READMEs (#1152)

[2.1.2] - 2024-03-22

  • Include license file with published packages (#1151)
Commits

Updates jason from 1.4.4 to 1.4.5

Changelog

Sourced from jason's changelog.

1.4.5 (05.05.2026)

  • Add support for Decimal 3.0
Commits
  • 4ede428 Bump v1.4.5
  • b8c2185 Fix dialyzer job
  • a363975 Modernise CI to currently supported versions
  • 243c8a8 Allow decimal 3.0
  • c8e8d05 Revert the experimental 1.5 branch and jason_native experiment
  • 0e7a3e2 Add example/doctest for Jason.OrderedObject.new/1
  • 984bc07 fix broken link
  • f775592 Raise if trying to decode decimals without decimal
  • 79d59df Remove unneeded workarounds for xref warnings
  • baac78e Fix warnings by conditionally compiling Decimal support
  • Additional commits viewable in compare view

Updates opentelemetry_exporter from 1.8.1 to 1.10.0

Release notes

Sourced from opentelemetry_exporter's releases.

API/SDK/OTLP Exporter 1.0.2 and Zipking Exporter 1.0.0

[API 1.0.2] - 2022-02-22

[SDK 1.0.2] - 2022-02-22

Added

Fixed

[Zipkin Exporter 1.0.0] - 2022-2-22

Fixed

Changelog

Sourced from opentelemetry_exporter's changelog.

This changelog has been split into a changelog per application found under apps/*. This file remains for changelogs before 2025-07-31.

Changelog

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

SDK 1.6.0 - 2025-09-16

Added

OTLP Exporter 1.9.0 - 2025-09-16

Added

API 1.4.1 - 2025-07-31

Fixes

  • Various type spec fixes

SDK 1.5.1 - 2025-07-31

Fixes

Commits

Updates phoenix from 1.8.0 to 1.8.9

Changelog

Sourced from phoenix's changelog.

1.8.9 (2026-07-07)

Security fixes

  • CVE-2026-56811: Add a max_channels_per_transport option (defaulting to 100) to prevent a single client from spawning an unbounded number of channels (processes), eventually exhausting the server's memory or process limit.
  • CVE-2026-56812: Prevent presence keys from colliding with Object.prototype properties members, crashing the JS Presence client
  • Enforce longpoll batch size introduced in 1.8.6. This is additional hardening against CVE-2026-32689. If your application sends events with a very high frequency and uses long polling, such that a single longpoll request would exceed 100 events, you should update to 1.8.7 first.

1.8.8 (2026-06-10)

Enhancements

  • [phx.new] Use LiveView 1.2.0

1.8.7 (2026-05-06)

Bug fixes

  • Fix invalid status when longpoll request times out

Enhancements

  • Mask token parameter in logs by default (in addition to "password")

JavaScript Client Bug Fixes

  • Fix encoding of non-ASCII metadata in binary channel messages

1.8.6 (2026-05-05)

Security fixes

  • CVE-2026-32689: Fix Phoenix.Socket Longpoll transport memory exhaustion in nd-JSON body splitting

Enhancements

  • [phoenix] Raise if use Phoenix.VerifiedRoutes is called multiple times in the same module
  • [phoenix] Fix more deprecation and type checker warnings on Elixir 1.20
  • [phoenix] Raise when interpolating a list in Phoenix.VerifiedRoutes (#6632)
  • [phoenix] Gracefully handle non-binary vsn socket parameter (#6662)
  • [phx.gen.*] Use .eex filename suffix in generator files
  • [phx.new] Add interactive mode: mix phx.new --interactive (#6630)
  • [phx.new] Add phx-no-format to generated <.live_title> tag (#6667)

Bug fixes

  • [phx.gen.*] Fix generated migrations for myxql when using scopes (#6635)
  • [phx.new] Fix crash when parent directory contains a colon (#6633)

1.8.5 (2026-03-05)

JavaScript Client Bug Fixes

  • Fix socket connecting on visibility change when never established

Enhancements

  • Fix warnings on Elixir 1.20

1.8.4 (2026-02-23)

... (truncated)

Commits
  • 734c8d1 Release v1.8.9
  • beffc4d fix presence keys colliding with object prototype chain
  • 16e295d Limit the number of channels a single transport process can join
  • 211ff62 Allow authToken to be a function (#6751)
  • 6cb2a83 Enforce longpoll batch size
  • 5bf1ce6 Add missing test file
  • 046accc Normalize route verb while grouping
  • 21d1462 Group routes by verb during compilation (#6739)
  • 9d3f1f6 phx.gen.release: Document new Bob Web UI (#6721)
  • afcac09 Bump undici from 7.25.0 to 7.28.0 (#6736)
  • Additional commits viewable in compare view

Updates phoenix_html from 4.2.1 to 4.3.0

Changelog

Sourced from phoenix_html's changelog.

4.3.0 (2025-09-28)

  • Enhancements

    • Implement Phoenix.HTML.Safe for Duration
    • Add function head for argument names of normalize_value/2 to improve documentation
    • Allow custom tags in options_for_select
    • Allow datetime as form option values

  • Bug fixes

    • Avoid false positive warnings on Elixir v1.19
Commits

Updates phoenix_live_view from 1.1.3 to 1.2.7

Release notes

Sourced from phoenix_live_view's releases.

v1.2.7

Security fixes

  • CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

v1.2.6

Bug fixes

  • Fix HTMLFormatter inserting extra characters in template with multi-codepoint emojis (#4321)

v1.2.5

Enhancements

  • Ensure Phoenix.LiveView.TagEngine's EEx.Engine deprecation warning includes file and line information
  • Ensure a failing custom UploadWriter does not crash the LiveView process (#4320)

v1.2.4

Bug fixes

  • Only warn about missing form ID when recovery actually applies (#4315)
  • Add common img attributes to live_img_preview/1 that were missing after cleaning the global attribute list in 1.2.0 (#4316)
  • Fix colocated CSS attributes being dropped if using colocated JS in the same component (#4319)

v1.2.3

This is a followup release to v1.2.2 that fixes the TypeScript declaration files being in the wrong subfolder. Again, it does not contain any changes to the Elixir or JavaScript code itself.

v1.2.2

This release fixes the npm package missing the TypeScript declaration files. It does not contain any changes to the Elixir or JavaScript code itself, except small documentation improvements.

v1.2.1

Bug fixes

  • Fix stale events from the previous LiveView being sent to the new LiveView after a live redirect (#4291)

v1.2.0

Enhancements

  • Support events pushed when connected mount redirects (#4269)

Bug fixes

... (truncated)

Changelog

Sourced from phoenix_live_view's changelog.

v1.2.7 (2026-07-13)

Security fixes

  • CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

v1.2.6 (2026-07-07)

Bug fixes

  • Fix HTMLFormatter inserting extra characters in template with multi-codepoint emojis (#4321)

v1.2.5 (2026-06-30)

Enhancements

  • Ensure Phoenix.LiveView.TagEngine's EEx.Engine deprecation warning includes file and line information
  • Ensure a failing custom UploadWriter does not crash the LiveView process (#4320)

v1.2.4 (2026-06-29)

Bug fixes

  • Only warn about missing form ID when recovery actually applies (#4315)
  • Add common img attributes to live_img_preview/1 that were missing after cleaning the global attribute list in 1.2.0 (#4316)
  • Fix colocated CSS attributes being dropped if using colocated JS in the same component (#4319)

v1.2.3 (2026-06-12)

This is a followup release to v1.2.2 that fixes the TypeScript declaration files being in the wrong subfolder. Again, it does not contain any changes to the Elixir or JavaScript code itself.

v1.2.2 (2026-06-12)

This release fixes the npm package missing the TypeScript declaration files. It does not contain any changes to the Elixir or JavaScript code itself, except small documentation improvements.

v1.2.1 (2026-06-11)

Bug fixes

  • Fix stale events from the previous LiveView being sent to the new LiveView after a live redirect (#4291)

v1.2.0 (2026-06-10) 🚀

Enhancements

  • Support events pushed when connected mount redirects (#4269)

Bug fixes

... (truncated)

Commits
  • 2570f65 update node
  • 0aa35cd Release v1.2.7
  • 8616553 revert 4b63216, add test
  • dacbd15 Update support information for LV version 1.2
  • b0946d5 Update assets
  • 716dab9 Don't set clientsideIdAttribute if ID is the same (#4327)
  • 521b4ef Release v1.2.6
  • f820721 Fix HTMLFormatter inserting extra characters in templates with multi-codepoin...
  • 2c33b9e Release v1.2.5
  • d4a019e Stop upload channel with {:shutdown, :closed} on writer error so the LiveView...
  • Additional commits viewable in compare view

Updates req from 0.5.15 to 0.6.3

Release notes

Sourced from req's releases.

v0.6.1

v0.6.0

  • encode_body: Security fix for :form_multipart header injection (GHSA-px9f-whj3-246m).

    The multipart encoder interpolated the per-part name, filename, and content_type into the part headers without escaping, so an attacker-controlled value could inject extra headers or smuggle additional parts into the request. These values are now escaped per RFC 7578 / WHATWG form-data (", CR, and LF are percent-encoded).

    Thanks to @​PJUllrich for reporting it.

  • decode_body: Drop automatic zip/tar/tgz/gz/zst/csv decoding, (GHSA-655f-mp8p-96gv).

    Req previously auto-decoded archive and compressed response bodies (zip, tar, tgz, gz, zst, and csv) based on the server-supplied content-type, materialising the full decompressed contents in memory with no size cap. An attacker-controlled (or redirect-reachable) endpoint could return a tiny "decompression bomb" that expanded to gigabytes and exhausted the node's memory.

    Now only JSON is decoded by default. Other formats are opt-in via the new :decoders option, which defaults to [:json, :json_api]. Setting it replaces the default (include :json to keep JSON decoding), and false disables all decoding:

    # opt into archives (only for endpoints you trust):
Req.get!(url, decoders: [:json, :zip])

    Note: The decoded zip/tar is still list of {filename :: charlist(), contents :: binary} tuples. In the future release, this will be list of {filename :: binary(), contents :: binary()} tuples.

    While automatic CSV decoding wasn't a security issue, the behaviour based on presence/absence of nimble_csv dependency was suprising. CSV support is still built-in but need to be enabled with decoders: [:csv].

... (truncated)

Changelog

Sourced from req's changelog.

v0.6.3 (2026-07-16)

  • [Req.Test]: Fix race condition

v0.6.2 (2026-06-19)

  • Use finch ~> 0.21.

v0.6.1 (2026-06-08)

  • [compressed], [decompress_body]: Disable automatic decompression

    Decompression is now opt-in by setting compressed: true.

v0.6.0 (2026-06-08)

  • [encode_body]: Security fix for :form_multipart header injection (GHSA-px9f-whj3-246m).

    The multipart encoder interpolated the per-part name, filename, and content_type into the part headers without escaping, so an attacker-controlled value could inject extra headers or smuggle additional parts into the request. These values are now escaped per RFC 7578 / WHATWG form-data (", CR, and LF are percent-encoded).

    Thanks to @​PJUllrich for reporting it.

  • [decode_body]: Drop automatic zip/tar/tgz/gz/zst/csv decoding, (GHSA-655f-mp8p-96gv).

    Req previously auto-decoded archive and compressed response bodies (zip, tar, tgz, gz, zst, and csv) based on the server-supplied content-type, materialising the full decompressed contents in memory with no size cap. An attacker-controlled (or redirect-reachable) endpoint could return a tiny "decompression bomb" that expanded to gigabytes and exhausted the node's memory.

    Now only JSON is decoded by default. Other formats are opt-in via the new :decoders option, which defaults to [:json, :json_api]. Setting it replaces the default (include :json to keep JSON decoding), and false disables all decoding:

    # opt into archives (only for endpoints you trust):
Req.get!(url, decoders: [:json, :zip])

    Note: The decoded zip/tar is still list of {filename :: charlist(), contents :: binary} tuples. In the future release, this will be list of {filename :: binary(), contents :: binary()} tuples.

... (truncated)

Commits
  • ed7b543 Release v0.6.3
  • a3a7bf3 Fix bug when Req.Test.fetch_plug/1 called after mode set to shared (#528)
  • f2c833c Release v0.6.2
  • f082be9 Use finch ~> 0.21
  • 36a8252 Release v0.6.1
  • ea5506f compressed, decompress_body: Disable automatic decompression
  • 8e7425f Release v0.6.0
  • 584a490 decode_body: Drop automatic zip/tar/tgz/gz/zst/csv decoding
  • 2d77dbe encode_body: Security fix for :form_multipart header injection
  • 53c3b99 Release v0.5.18
  • Additional commits viewable in compare view

Updates swoosh from 1.19.5 to 1.26.3

Release notes

Sourced from swoosh's releases.

v1.26.3

🔒 Security

  • Fix URL path injection via unencoded sender address in MsGraph adapter (GHSA-754j-98wh-57rf / CVE-2026-54893)

v1.26.2 🚀

🐛 Bug Fixes

  • Fix Postmark adapter not adding the Recipient's name to the Reply-To header @​vickz84259 (#1166)

🧰 Maintenance

  • Replace deprecated xref: [exclude:] with elixirc_options: [no_warn_undefined:] @​princemaple (#1165)

⛓️ Dependency

v1.26.1 🚀

🐛 Bug Fixes

  • fix fat-fingering content_id instead of cid, added tests, fixed outdated expected response in mua_test.exs @​waseigo (#1155)

🧰 Maintenance

v1.26.0 🚀

✨ Features

⛓️ Dependency

New Contributors

Full Changelog: swoosh/swoosh@1.25.3...v1.26.0

v1.25.3 🚀

📝 Documentation

... (truncated)

Changelog

Sourced from swoosh's changelog.

1.26.3

🔒 Security

  • Fix URL path injection via unencoded sender address in MsGraph adapter (GHSA-754j-98wh-57rf / CVE-2026-54893)

1.26.2

🐛 Bug Fixes

  • Fix Postmark adapter not adding the recipient name to the Reply-To header @​vickz84259 (#1166)

1.26.1

🐛 Bug Fixes

1.26.0

✨ Features

📝 Documentation

  • Document the new Mailpit adapter in the README

1.25.3

📝 Documentation

🧰 Maintenance

1.25.2

🐛 Bug Fixes

1.25.1

🐛 Bug Fixes

... (truncated)

Commits
  • 72a874f Prepare 1.26.3 patch release files
  • e382354 Merge commit from fork
  • 6bfb8ff chore: bump version to 1.26.2 (#1167)
  • a9b559e Merge pull request #1166 from vickz84259/fix-postmark-reply-to
  • 044ea15 bumps
  • 7cbcb3c bumps
  • 6de8cf1 Merge pull request #1157 from swoosh/dependabot/hex/bandit-1.12.0
  • 8d88c57 Bump bandit from 1.11.1 to 1.12.0
  • 86b8b70 Replace deprecated xref: [exclude:] with elixirc_options: [no_warn_undefined:...
  • 813b758 Bump req from 0.5.18 to 0.6.1 (#1158)
  • Additional commits viewable in compare view

Updates tailwind from 0.3.1 to 0.5.1

Changelog

Sourced from tailwind's changelog.

v0.5.1 (2026-06-16)

  • Fix executable name on Windows

v0.5.0 (2026-06-11)

  • Allow configuring :version per profile
  • Allow env values to be lists, joined by the OS path separator

v0.4.1 (2025-10-17)

  • Ignore ANSI escape codes when checking version

v0.4.0 (2025-09-10)

  • No longer copy assets in mix tailwind.install
  • Discard empty proxy env vars
  • Ensure watcher picks up rule changes on Windows
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the mix-production-dependencies group across 1 dire…
0d0b7ad 
…ctory with 12 updates

Bumps the mix-production-dependencies group with 11 updates in the /src/flagd-ui directory:

| Package | From | To |
| --- | --- | --- |
| [bandit](https://github.com/mtrudel/bandit) | `1.7.0` | `1.12.0` |
| [dns_cluster](https://github.com/phoenixframework/dns_cluster) | `0.1.3` | `0.2.0` |
| [gettext](https://github.com/elixir-gettext/gettext) | `0.26.2` | `1.0.2` |
| [heroicons](https://github.com/tailwindlabs/heroicons) | `v2.1.1` | `v2.2.0` |
| [jason](https://github.com/michalmuskala/jason) | `1.4.4` | `1.4.5` |
| [opentelemetry_exporter](https://github.com/open-telemetry/opentelemetry-erlang) | `1.8.1` | `1.10.0` |
| [phoenix](https://github.com/phoenixframework/phoenix) | `1.8.0` | `1.8.9` |
| [phoenix_live_view](https://github.com/phoenixframework/phoenix_live_view) | `1.1.3` | `1.2.7` |
| [req](https://github.com/wojtekmach/req) | `0.5.15` | `0.6.3` |
| [swoosh](https://github.com/swoosh/swoosh) | `1.19.5` | `1.26.3` |
| [tailwind](https://github.com/phoenixframework/tailwind) | `0.3.1` | `0.5.1` |



Updates `bandit` from 1.7.0 to 1.12.0
- [Changelog](https://github.com/mtrudel/bandit/blob/main/CHANGELOG.md)
- [Commits](mtrudel/bandit@1.7.0...1.12.0)

Updates `dns_cluster` from 0.1.3 to 0.2.0
- [Changelog](https://github.com/phoenixframework/dns_cluster/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/dns_cluster@v0.1.3...v0.2.0)

Updates `gettext` from 0.26.2 to 1.0.2
- [Changelog](https://github.com/elixir-gettext/gettext/blob/main/CHANGELOG.md)
- [Commits](elixir-gettext/gettext@v0.26.2...v1.0.2)

Updates `heroicons` from v2.1.1 to v2.2.0
- [Release notes](https://github.com/tailwindlabs/heroicons/releases)
- [Changelog](https://github.com/tailwindlabs/heroicons/blob/master/CHANGELOG.md)
- [Commits](tailwindlabs/heroicons@88ab3a0...0435d4c)

Updates `jason` from 1.4.4 to 1.4.5
- [Release notes](https://github.com/michalmuskala/jason/releases)
- [Changelog](https://github.com/michalmuskala/jason/blob/master/CHANGELOG.md)
- [Commits](michalmuskala/jason@v1.4.4...v1.4.5)

Updates `opentelemetry_exporter` from 1.8.1 to 1.10.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-erlang/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-erlang/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-erlang/commits/opentelemetry_exporter/v1.10.0)

Updates `phoenix` from 1.8.0 to 1.8.9
- [Release notes](https://github.com/phoenixframework/phoenix/releases)
- [Changelog](https://github.com/phoenixframework/phoenix/blob/v1.8.9/CHANGELOG.md)
- [Commits](phoenixframework/phoenix@v1.8.0...v1.8.9)

Updates `phoenix_html` from 4.2.1 to 4.3.0
- [Changelog](https://github.com/phoenixframework/phoenix_html/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/phoenix_html@v4.2.1...v4.3.0)

Updates `phoenix_live_view` from 1.1.3 to 1.2.7
- [Release notes](https://github.com/phoenixframework/phoenix_live_view/releases)
- [Changelog](https://github.com/phoenixframework/phoenix_live_view/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/phoenix_live_view@v1.1.3...v1.2.7)

Updates `req` from 0.5.15 to 0.6.3
- [Release notes](https://github.com/wojtekmach/req/releases)
- [Changelog](https://github.com/wojtekmach/req/blob/main/CHANGELOG.md)
- [Commits](wojtekmach/req@v0.5.15...v0.6.3)

Updates `swoosh` from 1.19.5 to 1.26.3
- [Release notes](https://github.com/swoosh/swoosh/releases)
- [Changelog](https://github.com/swoosh/swoosh/blob/main/CHANGELOG.md)
- [Commits](swoosh/swoosh@v1.19.5...v1.26.3)

Updates `tailwind` from 0.3.1 to 0.5.1
- [Changelog](https://github.com/phoenixframework/tailwind/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/tailwind@v0.3.1...v0.5.1)

---
updated-dependencies:
- dependency-name: bandit
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-production-dependencies
- dependency-name: dns_cluster
  dependency-version: 0.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-production-dependencies
- dependency-name: gettext
  dependency-version: 1.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: mix-production-dependencies
- dependency-name: heroicons
  dependency-version: 0435d4ca364a608cc75e2f8683d374e55abbae26
  dependency-type: direct:production
  dependency-group: mix-production-dependencies
- dependency-name: jason
  dependency-version: 1.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-production-dependencies
- dependency-name: opentelemetry_exporter
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-production-dependencies
- dependency-name: phoenix
  dependency-version: 1.8.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-production-dependencies
- dependency-name: phoenix_html
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-production-dependencies
- dependency-name: phoenix_live_view
  dependency-version: 1.2.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-production-dependencies
- dependency-name: req
  dependency-version: 0.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-production-dependencies
- dependency-name: swoosh
  dependency-version: 1.26.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-production-dependencies
- dependency-name: tailwind
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code labels Jul 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants