Skip to content

chore(deps): bump the production-dependencies group with 5 updates - #418

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/production-dependencies-09d36b65f4
Closed

chore(deps): bump the production-dependencies group with 5 updates#418
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/production-dependencies-09d36b65f4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 5 updates:

Package From To
ash 3.29.3 3.31.0
ash_phoenix 2.3.23 2.3.24
cinder 0.15.0 0.16.0
phoenix 1.8.8 1.8.9
phoenix_live_view 1.2.5 1.2.8

Updates ash from 3.29.3 to 3.31.0

Release notes

Sourced from ash's releases.

v3.31.0

Features:

Bug Fixes:

Improvements:

v3.30.1

Bug Fixes:

v3.30.0

Features:

... (truncated)

Changelog

Sourced from ash's changelog.

v3.31.0 (2026-07-28)

Features:

Bug Fixes:

Improvements:

v3.30.1 (2026-07-21)

Bug Fixes:

v3.30.0 (2026-07-21)

Features:

... (truncated)

Commits
  • 6c0357d chore: release version v3.31.0
  • 27af998 fix: order durations semantically instead of by struct field layout (#2809)
  • 1d0b599 improvement: avoid quadratic cost evaluating in-list filters at runtime (#2802)
  • eb7f5ef feat: add units constraint to Ash.Type.Duration (#2811)
  • a3c3c78 fix: compare with Comp in intersects function
  • eed63f2 feat: add mfa constraint to Ash.Type.Function for portable persistence (#2807)
  • 9159464 fix: compare a Decimal to a float instead of raising (#2805)
  • 90baa9f fix: ensure related aggregates set the proper resource
  • 4d27beb improvement: add strict? constraint to Ash.Type.UUIDv7 (#2795)
  • 023c35e feat: add all/1 builtin validation as the complement to any/1 (#2800)
  • Additional commits viewable in compare view

Updates ash_phoenix from 2.3.23 to 2.3.24

Release notes

Sourced from ash_phoenix's releases.

v2.3.24

Bug Fixes:

  • Rename Ash.Resource.record() -> Ash.Resource.Record.t() by @​jimsynz
Changelog

Sourced from ash_phoenix's changelog.

v2.3.24 (2026-07-08)

Bug Fixes:

  • Rename Ash.Resource.record() -> Ash.Resource.Record.t() by @​jimsynz
Commits
  • 0d0421c chore: release version v2.3.24
  • 0d40671 fix: Rename Ash.Resource.record() -> Ash.Resource.Record.t()
  • 54030e4 chore(deps): Update hpax, mint and phoenix because of CVEs
  • 99c6526 chore: Fix reuse on macOS
  • 6d119c3 chore(deps): Unlock libgraph
  • a997152 chore(deps): bump the production-dependencies group across 1 directory with 5...
  • 1eb145a chore(deps-dev): bump credo in the dev-dependencies group (#478)
  • See full diff in compare view

Updates cinder from 0.15.0 to 0.16.0

Changelog

Sourced from cinder's changelog.

v0.16.0 (2026-07-15)

Breaking changes

  • Removed the sort_asc_icon, sort_desc_icon, and sort_icon_class theme properties — list and grid layouts now render the same Heroicon sort indicators as the table (configured via sort_*_icon_name/sort_*_icon_class). See the upgrading guide for details.

Features

  • Added item_class on <Cinder.collection> (and <Cinder.Table.table>) to set a per-row/item class: a string, or a fn item -> class end function evaluated per item, appended to the theme's row/item class.

Bugfixes

  • *_nils_first/*_nils_last sort methods now render an icon in list and grid views.
Commits
  • 3b1c868 Tag and release v0.16.0
  • a692f35 Merge pull request #201 from sevenseacat/dependabot/hex/ash_phoenix-2.3.24
  • 80301e7 Bump ash_phoenix from 2.3.23 to 2.3.24
  • ddafd1c Merge pull request #200 from sevenseacat/dependabot/hex/phoenix_live_view-1.2.7
  • 4b8d308 Merge pull request #195 from sevenseacat/dependabot/hex/ash-3.29.3
  • a39db1c Bump phoenix_live_view from 1.2.6 to 1.2.7
  • b288dae Bump ash from 3.29.2 to 3.29.3
  • 3422e76 Merge pull request #199 from sevenseacat/dependabot/hex/phoenix_live_view-1.2.6
  • 30180e6 Bump phoenix_live_view from 1.2.3 to 1.2.6
  • 361f7d1 Merge pull request #193 from sevenseacat/dependabot/hex/ash-3.29.2
  • Additional commits viewable in compare view

Updates phoenix from 1.8.8 to 1.8.9

Changelog

Sourced from phoenix's changelog.

1.8.9 (2026-07-07)

Security fixes

  • CVE-2026-56811: Add a max_channels_per_transport option (defaulting to 100) to prevent a single client from spawning an unbounded number of channels (processes), eventually exhausting the server's memory or process limit.
  • CVE-2026-56812: Prevent presence keys from colliding with Object.prototype properties members, crashing the JS Presence client
  • Enforce longpoll batch size introduced in 1.8.6. This is additional hardening against CVE-2026-32689. If your application sends events with a very high frequency and uses long polling, such that a single longpoll request would exceed 100 events, you should update to 1.8.7 first.
Commits
  • 734c8d1 Release v1.8.9
  • beffc4d fix presence keys colliding with object prototype chain
  • 16e295d Limit the number of channels a single transport process can join
  • 211ff62 Allow authToken to be a function (#6751)
  • 6cb2a83 Enforce longpoll batch size
  • 5bf1ce6 Add missing test file
  • 046accc Normalize route verb while grouping
  • 21d1462 Group routes by verb during compilation (#6739)
  • 9d3f1f6 phx.gen.release: Document new Bob Web UI (#6721)
  • afcac09 Bump undici from 7.25.0 to 7.28.0 (#6736)
  • Additional commits viewable in compare view

Updates phoenix_live_view from 1.2.5 to 1.2.8

Release notes

Sourced from phoenix_live_view's releases.

v1.2.8

Enhancements

  • Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
  • Sign LiveView upload tokens as :local to avoid node names being included in the token
  • Ensure async tasks exit gracefully in LiveView tests (#4348)
  • Allow opting focused form elements into DOM patching (#4339)

Bug fixes

  • Fix server close handler not being reattached after a manual disconnect + connect (#4341)
  • Fix detail.lock() promise in phx:push event never resolving (#4351)
  • Fix live components not being correctly patched when changing their DOM ID (#4338)
  • Gracefully handle missing upload refs (#4354)

v1.2.7

Security fixes

  • CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

v1.2.6

Bug fixes

  • Fix HTMLFormatter inserting extra characters in template with multi-codepoint emojis (#4321)
Changelog

Sourced from phoenix_live_view's changelog.

v1.2.8 (2026-07-27)

Enhancements

  • Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
  • Sign LiveView upload tokens as :local to avoid node names being included in the token
  • Ensure async tasks exit gracefully in LiveView tests (#4348)
  • Allow opting focused form elements into DOM patching (#4339)

Bug fixes

  • Fix server close handler not being reattached after a manual disconnect + connect (#4341)
  • Fix detail.lock() promise in phx:push event never resolving (#4351)
  • Fix live components not being correctly patched when changing their DOM ID (#4338)
  • Gracefully handle missing upload refs (#4354)

v1.2.7 (2026-07-13)

Security fixes

  • CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

v1.2.6 (2026-07-07)

Bug fixes

  • Fix HTMLFormatter inserting extra characters in template with multi-codepoint emojis (#4321)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group with 5 updates
b871e79 
Bumps the production-dependencies group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [ash](https://github.com/ash-project/ash) | `3.29.3` | `3.31.0` |
| [ash_phoenix](https://github.com/ash-project/ash_phoenix) | `2.3.23` | `2.3.24` |
| [cinder](https://github.com/sevenseacat/cinder) | `0.15.0` | `0.16.0` |
| [phoenix](https://github.com/phoenixframework/phoenix) | `1.8.8` | `1.8.9` |
| [phoenix_live_view](https://github.com/phoenixframework/phoenix_live_view) | `1.2.5` | `1.2.8` |


Updates `ash` from 3.29.3 to 3.31.0
- [Release notes](https://github.com/ash-project/ash/releases)
- [Changelog](https://github.com/ash-project/ash/blob/main/CHANGELOG.md)
- [Commits](ash-project/ash@v3.29.3...v3.31.0)

Updates `ash_phoenix` from 2.3.23 to 2.3.24
- [Release notes](https://github.com/ash-project/ash_phoenix/releases)
- [Changelog](https://github.com/ash-project/ash_phoenix/blob/main/CHANGELOG.md)
- [Commits](ash-project/ash_phoenix@v2.3.23...v2.3.24)

Updates `cinder` from 0.15.0 to 0.16.0
- [Changelog](https://github.com/sevenseacat/cinder/blob/main/CHANGELOG.md)
- [Commits](sevenseacat/cinder@v0.15.0...v0.16.0)

Updates `phoenix` from 1.8.8 to 1.8.9
- [Release notes](https://github.com/phoenixframework/phoenix/releases)
- [Changelog](https://github.com/phoenixframework/phoenix/blob/v1.8.9/CHANGELOG.md)
- [Commits](phoenixframework/phoenix@v1.8.8...v1.8.9)

Updates `phoenix_live_view` from 1.2.5 to 1.2.8
- [Release notes](https://github.com/phoenixframework/phoenix_live_view/releases)
- [Changelog](https://github.com/phoenixframework/phoenix_live_view/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/phoenix_live_view@v1.2.5...v1.2.8)

---
updated-dependencies:
- dependency-name: ash
  dependency-version: 3.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: ash_phoenix
  dependency-version: 2.3.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: cinder
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: phoenix
  dependency-version: 1.8.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: phoenix_live_view
  dependency-version: 1.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code labels Aug 1, 2026
@zachdaniel

zachdaniel commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 1, 2026
@dependabot
dependabot Bot deleted the dependabot/hex/production-dependencies-09d36b65f4 branch August 1, 2026 17:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@zachdaniel