Bump the elixir group across 1 directory with 6 updates

[dependabot]

Bumps the elixir group with 5 updates in the / directory:

Package	From	To
credo	1.7.18	1.7.19
ex_doc	0.40.1	0.40.3
phoenix	1.8.5	1.8.9
phx_new	1.8.5	1.8.9
styler	1.11.0	1.12.0

Updates credo from 1.7.18 to 1.7.19

Release notes

Sourced from credo's releases.

v1.17.19

Check it out on Hex: https://hex.pm/packages/credo/1.7.19

• Fix compatibility & compiler warnings with Elixir 1.20.0

Changelog

Sourced from credo's changelog.

1.7.19

• Fix compatibility & compiler warnings with Elixir 1.20.0

Commits

• d4a88d4 Bump version to 1.7.19
• b87f0b6 Update CHANGELOG
• c4ed6df Use mix format
• 9172f39 Fix token error
• a6de9b5 Add reproducing test for #1275
• b726ad4 Run mix format
• ccd27fb Add test for sigil_p position
• 8a03b78 Clean stale deps
• a902c97 Set "old credo" to 1.7.18
• cc2ce91 Update GitHub actions
• Additional commits viewable in compare view

Updates ex_doc from 0.40.1 to 0.40.3

Changelog

Sourced from ex_doc's changelog.

v0.40.3 (2026-05-21)

• Enhancements
  • Add autolinking for Erlang/OTP 29 native records

v0.40.2 (2026-05-08)

• Bug fixes
  • Add rel="nofollow" to external links in HTML output
  • Use blockquote in llms.txt description
  • Void elements in epub, such wbr, must be terminated by the matching end-tag
  • Fix content container scrolling in older versions of Safari
  • Skip HTML comments when computing synopsis
  • Fix markdown backend code fence language and opaque type display
  • Fix false positive warning when linking to asset files
  • Prevent #search selector from impacting user content
  • Raise on extras that conflict with reserved filenames
  • Fix styling of admonition blocks

Commits

• 07a6abc Release v0.40.3
• 02904bb Fix record autolink - and bump CI (#2240)
• c868c6a Release v0.40.2
• b9cc372 Update makeup_erlang version (#2236)
• b389d17 Fix dead code and overriden clauses found by the type system
• 25523c9 Update assets
• dbed340 Raise on extras that conflict with reserved filenames
• 2808e45 Prevent #search selector from impacting user content
• bc90968 Update assets
• 9333979 Fix inline code font size in headings (#2220)
• Additional commits viewable in compare view

Updates phoenix from 1.8.5 to 1.8.9

Changelog

Sourced from phoenix's changelog.

1.8.9 (2026-07-07)

Security fixes

• CVE-2026-56811: Add a max_channels_per_transport option (defaulting to 100) to prevent a single client from spawning an unbounded number of channels (processes), eventually exhausting the server's memory or process limit.
• CVE-2026-56812: Prevent presence keys from colliding with Object.prototype properties members, crashing the JS Presence client
• Enforce longpoll batch size introduced in 1.8.6. This is additional hardening against CVE-2026-32689. If your application sends events with a very high frequency and uses long polling, such that a single longpoll request would exceed 100 events, you should update to 1.8.7 first.

1.8.8 (2026-06-10)

Enhancements

• [phx.new] Use LiveView 1.2.0

1.8.7 (2026-05-06)

Bug fixes

• Fix invalid status when longpoll request times out

Enhancements

• Mask token parameter in logs by default (in addition to "password")

JavaScript Client Bug Fixes

• Fix encoding of non-ASCII metadata in binary channel messages

1.8.6 (2026-05-05)

Security fixes

• CVE-2026-32689: Fix Phoenix.Socket Longpoll transport memory exhaustion in nd-JSON body splitting

Enhancements

• [phoenix] Raise if use Phoenix.VerifiedRoutes is called multiple times in the same module
• [phoenix] Fix more deprecation and type checker warnings on Elixir 1.20
• [phoenix] Raise when interpolating a list in Phoenix.VerifiedRoutes (#6632)
• [phoenix] Gracefully handle non-binary vsn socket parameter (#6662)
• [phx.gen.*] Use .eex filename suffix in generator files
• [phx.new] Add interactive mode: mix phx.new --interactive (#6630)
• [phx.new] Add phx-no-format to generated <.live_title> tag (#6667)

Bug fixes

• [phx.gen.*] Fix generated migrations for myxql when using scopes (#6635)
• [phx.new] Fix crash when parent directory contains a colon (#6633)

Commits

• 734c8d1 Release v1.8.9
• beffc4d fix presence keys colliding with object prototype chain
• 16e295d Limit the number of channels a single transport process can join
• 211ff62 Allow authToken to be a function (#6751)
• 6cb2a83 Enforce longpoll batch size
• 5bf1ce6 Add missing test file
• 046accc Normalize route verb while grouping
• 21d1462 Group routes by verb during compilation (#6739)
• 9d3f1f6 phx.gen.release: Document new Bob Web UI (#6721)
• afcac09 Bump undici from 7.25.0 to 7.28.0 (#6736)
• Additional commits viewable in compare view

Updates phx_new from 1.8.5 to 1.8.9

Changelog

Sourced from phx_new's changelog.

1.8.9 (2026-07-07)

Security fixes

• CVE-2026-56811: Add a max_channels_per_transport option (defaulting to 100) to prevent a single client from spawning an unbounded number of channels (processes), eventually exhausting the server's memory or process limit.
• CVE-2026-56812: Prevent presence keys from colliding with Object.prototype properties members, crashing the JS Presence client
• Enforce longpoll batch size introduced in 1.8.6. This is additional hardening against CVE-2026-32689. If your application sends events with a very high frequency and uses long polling, such that a single longpoll request would exceed 100 events, you should update to 1.8.7 first.

1.8.8 (2026-06-10)

Enhancements

• [phx.new] Use LiveView 1.2.0

1.8.7 (2026-05-06)

Bug fixes

• Fix invalid status when longpoll request times out

Enhancements

• Mask token parameter in logs by default (in addition to "password")

JavaScript Client Bug Fixes

• Fix encoding of non-ASCII metadata in binary channel messages

1.8.6 (2026-05-05)

Security fixes

• CVE-2026-32689: Fix Phoenix.Socket Longpoll transport memory exhaustion in nd-JSON body splitting

Enhancements

• [phoenix] Raise if use Phoenix.VerifiedRoutes is called multiple times in the same module
• [phoenix] Fix more deprecation and type checker warnings on Elixir 1.20
• [phoenix] Raise when interpolating a list in Phoenix.VerifiedRoutes (#6632)
• [phoenix] Gracefully handle non-binary vsn socket parameter (#6662)
• [phx.gen.*] Use .eex filename suffix in generator files
• [phx.new] Add interactive mode: mix phx.new --interactive (#6630)
• [phx.new] Add phx-no-format to generated <.live_title> tag (#6667)

Bug fixes

• [phx.gen.*] Fix generated migrations for myxql when using scopes (#6635)
• [phx.new] Fix crash when parent directory contains a colon (#6633)

Commits

• 734c8d1 Release v1.8.9
• beffc4d fix presence keys colliding with object prototype chain
• 16e295d Limit the number of channels a single transport process can join
• 211ff62 Allow authToken to be a function (#6751)
• 6cb2a83 Enforce longpoll batch size
• 5bf1ce6 Add missing test file
• 046accc Normalize route verb while grouping
• 21d1462 Group routes by verb during compilation (#6739)
• 9d3f1f6 phx.gen.release: Document new Bob Web UI (#6721)
• afcac09 Bump undici from 7.25.0 to 7.28.0 (#6736)
• Additional commits viewable in compare view

Updates plug from 1.19.1 to 1.20.3

Changelog

Sourced from plug's changelog.

v1.20.3 (2026-07-09)

Security

• [Plug.Parsers.MULTIPART] Count files and skipped multipart parts towards the length limit (CVE-2026-56814)
• [Plug.Conn.Cookies] Raise if ; is present in cookie attributes (CVE-2026-56813)

v1.20.2 (2026-06-30)

Bug fixes

• [Plug.Conn] Set state to :set_upgrade and status to 101 when running before_send callbacks for upgrades

v1.20.1 (2026-06-23)

Bug fixes

• [Plug.Conn] Fix inform/inform! when atoms are given as header keys

v1.20.0 (2026-06-23)

This release requires Elixir v1.15+.

Enhancements

• [Plug.RequestId] Make request ID generation configurable
• [Plug.Test] Support :sign and :encrypt options in put_req_cookie/4

Bug fixes

• [Plug.Conn] Run before_send callbacks before upgrade_adapter/3
• [Plug.Debugger] Raise if Elixir is compiled without source information
• [Plug.RewriteOn] Rewrite the protocol to HTTPS when x-forwarded-proto is wss
• [Plug.Static] Return 416 for invalid range requests
• [Plug.Static] Fix :raise_on_missing_only raising on non-matching paths with colons

Optimizations

• [Plug.Conn.Cookies] Optimize cookie parsing
• [Plug.Conn.Cookies] Optimize cookie encoding
• [Plug.Conn.Utils] Optimize validate_utf8!/3
• [Plug.Conn.Utils] Optimize splitting by semicolons
• [Plug.Router] Optimize host matching

v1.19.5 (2026-07-09)

Security

• [Plug.Parsers.MULTIPART] Count files and skipped multipart parts towards the length limit (CVE-2026-56814)
• [Plug.Conn.Cookies] Raise if ; is present in cookie attributes (CVE-2026-56813)

... (truncated)

Commits

• 9fa11c8 Release v1.20.3
• eceb831 Raise if ; is present in cookie attributes
• 56edca2 Count files and skipped multiparts towards length
• cf15f0a Release v1.20.2
• 5d0fe88 Fix register_before_send with upgrade_adapter (#1320)
• 1fea083 Release v1.20.1
• 9df2c0a Allow atom header keys in inform/3 (#1318)
• d8d733b Release v1.20.0
• b4aa8a0 Merge commit from fork
• ac94702 Validate headers in inform
• Additional commits viewable in compare view

Updates styler from 1.11.0 to 1.12.0

Release notes

Sourced from styler's releases.

v1.12.0

Improvements

• Pipes:
  • don't unpipe |> dbg, to help our friends who format-on-save and like throwing a quick dbg pipe in while debugging (h/t @​mhanberg)
  • optimize two DateTime.shift |> DateTime.shift into a single DateTime.shift when working with literal durations whose keys are disjoint
• Write "not equal" one way only: not (a == b), !(a == b) => a != b (#251, h/t @​tomkonidas)
• Deprecations: DateTime.add(dt, amount, unit) is rewritten to DateTime.shift(dt, unit: amount) for 1.17+ codebases. While not technically deprecated, Elixir docs recommend shift over add (#253, h/t @​tomkonidas)
• DateTime.shift(dt, ..duration pairs..) now has its duration pairs shrunk like to_timeout
• duration pair shrinking improved for precomputed values, for instance second: 86_400 => day: 1

Fixes

• General improvements to comment handling across Styler (#254, h/t me and claude)
• Fixed explicit-keyword-list merges not being rewritten to puts: Map/Keyword.merge([single: :key]) => Map/Keyword.put(:single, :key)

Changelog

Sourced from styler's changelog.

1.12.0

Improvements

• Pipes:
  • don't unpipe |> dbg, to help our friends who format-on-save and like throwing a quick dbg pipe in while debugging (h/t @​mhanberg)
  • optimize two DateTime.shift |> DateTime.shift into a single DateTime.shift when working with literal durations whose keys are disjoint
• Write "not equal" one way only: not (a == b), !(a == b) => a != b (#251, h/t @​tomkonidas)
• Deprecations: DateTime.add(dt, amount, unit) is rewritten to DateTime.shift(dt, unit: amount) for 1.17+ codebases. While not technically deprecated, Elixir docs recommend shift over add (#253, h/t @​tomkonidas)
• DateTime.shift(dt, ..duration pairs..) now has its duration pairs shrunk like to_timeout
• duration pair shrinking improved for precomputed values, for instance second: 86_400 => day: 1

Fixes

• General improvements to comment handling across Styler (#254, h/t me and claude)
• Fixed explicit-keyword-list merges not being rewritten to puts: Map/Keyword.merge([single: :key]) => Map/Keyword.put(:single, :key)

Commits

• 95a104b v1.12.0
• 9e60f7c Fix integers losing tokenized values in duration shrinking
• 9b22d62 fix meta swap in duration shrinking logic
• 2b01a16 run deprecations before pipes, so pipes can further shrink deprecations
• 5bcee4e futher improve duration shrinking
• 3268da0 fix shift |> shift not working when there are 3+ calls piped
• a14a414 pipes: DateTime.shift(a) |> DateTime.shift(b) => DateTime.shift(a ++ b) when ...
• 1788686 dont unpipe dbg pipes. h/t @​mhanberg
• 1c65b7e add test for bug in duration shrinking
• 97a1c7b move DateTime.shift code to Deprecations to remind myself why i wanted it
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions