Bump sobelow from 0.11.1 to 0.16.0

[dependabot]

Bumps sobelow from 0.11.1 to 0.16.0.

Release notes

Sourced from sobelow's releases.

v0.16.0

What's Changed

• Improve Sobelow detection, reliability, performance, coverage, and architecture by @​houllette in sobelow/sobelow#47
• Add Github Workflow annotations output format by @​katafrakt in sobelow/sobelow#46
• Fix XSS false positives and harden raw and response-header analysis by @​houllette in sobelow/sobelow#48
• version bump - 0.16.0 by @​houllette in sobelow/sobelow#49

New Contributors

• @​katafrakt made their first contribution in sobelow/sobelow#46

Full Changelog: sobelow/sobelow@v0.15.0...v0.16.0

v0.15.0

What's Changed

• Fix nine crash-class bugs, add end-to-end test coverage, support Elixir 1.20 by @​houllette in sobelow/sobelow#34
• feat: Support inline # sobelow_skip comments on Phoenix router pipelines by @​houllette in sobelow/sobelow#35
• perf: only re-walk files that actually carry a sobelow_skip attribute by @​houllette in sobelow/sobelow#36
• fix: tolerate empty .sobelow-conf files instead of failing the scan by @​houllette in sobelow/sobelow#37
• perf: Run check tasks in parallel by @​s3cur3 in sobelow/sobelow#23
• Reduce churn: Sort lines in .sobelow-skips file by their value instead of the findings’ fingerprints by @​sesamzoo in sobelow/sobelow#24
• Allow possibility to remove missing router warning (issue #25) by @​a-maze-d in sobelow/sobelow#26
• fix: Stop discarding # sobelow_skip comments over whitespace, and warn when one cannot be read by @​houllette in sobelow/sobelow#39
• Fix for Workflow does not contain permissions issue by @​houllette in sobelow/sobelow#41
• fix: Only match unqualified query/query! where Ecto is in scope by @​houllette in sobelow/sobelow#38
• fix: Stop .sobelow-conf from being able to disable the scan by @​houllette in sobelow/sobelow#42
• version bump - 0.15.0 by @​houllette in sobelow/sobelow#43

New Contributors

• @​s3cur3 made their first contribution in sobelow/sobelow#23
• @​sesamzoo made their first contribution in sobelow/sobelow#24
• @​a-maze-d made their first contribution in sobelow/sobelow#26

Full Changelog: sobelow/sobelow@v0.14.1...v0.15.0

v0.14.1

• Enhancements
  • Implicitly use .sobelow-conf if detected in the root directory rather than require --config switch. The --no-config switch is still supported to prevent any settings from being read in from the file if needed.
  • Added guidance for warn_if_outdated option in mix deps
  • Added support for Elixir v1.19.x
• Bug fixes
  • Handled extra config options for app releases in mix.exs
  • Properly handle the use of CLI switches and config file settings in the same run. These would previously clobber each other in unapparent ways leading to confusing behavior. CLI switch take precedence.
  • .sobelow-conf now sorted alphabetically
  • Fix edwarning from zero argument functions
  • Fixed broken skip funcationality
  • Fixed broken GitHub Actions CI

... (truncated)

Changelog

Sourced from sobelow's changelog.

v0.16.0

• Bug fixes
  • XSS.Raw no longer reports calls to a benign local raw helper with the matching arity, including defaults, guards, pipes, captures, and inline HEEx. Local definitions stay within their module; qualified Phoenix calls and implicitly imported template helpers retain detection. Helpers returning dynamic {:safe, value} output or wrapping another raw call retain their caller's original findings, locations, and fingerprints. (#44)
  • XSS.SendResp now recognizes put_resp_header(conn, "content-type", type) on the response connection, including piped, aliased, nested, and assigned calls. HTML, SVG, malformed, and unknown types still report; other XML and PDF document types retain low-confidence findings. Discarded, later, unrelated, locally shadowed, or ambiguously imported setters cannot suppress findings. Known unrelated response headers retain the connection's content type, and MIME parameters do not change its classification. (#45)
  • XSS.Raw now respects explicit imports of unrelated raw helpers. Unknown raw macros and delegates retain detection. Older inline lexical contexts without local-signature metadata remain supported.
  • Invalid project roots, roots with no scannable source files, invalid scan options, and unwritable output files now fail with actionable errors.
  • Repeated scans in the same VM now start with fresh findings, template, and skip state. Malformed sources and templates are skipped with a warning in non-strict mode, and unreadable files are skipped with a warning.
  • Dynamic socket options, literal statements in router pipelines, and access on a literal keyword list no longer abort scans. Unknown socket options produce low-confidence findings.
  • XSS.SendResp now follows the connection passed to each response and its content type before that sink. Later or discarded setters cannot suppress an earlier finding, and rebindings in branches, patterns, callbacks, generators, and call arguments cannot borrow another connection's content type. Unchanged bindings, pins, guards, and explicit setters retain their existing handling.
  • HTTPS and HSTS checks now use effective settings for the scanned application and each endpoint, including ordered overrides and nested keyword merges. One endpoint cannot satisfy another's settings. Dynamic and conditional settings produce low-confidence findings. Empty CSP policies are reported.
  • Enabled sockets now inherit endpoint origin settings from base, production, and runtime configuration, including socket/2 and websocket: true. Explicit socket overrides retain precedence, and disabled WebSockets remain excluded. Defaults are isolated to each endpoint module. Origin allowlists and :conn are recognized; an enabled CSRF check lowers confidence when origin checks are disabled.
  • HEEx comments and script/style text no longer change brace-interpolation scope or introduce findings from literal markup. The phx-no-curly-interpolation directive is recognized as an attribute name; the same text inside another attribute's value cannot suppress findings. Inline columns account for sigil prefixes and heredoc indentation.
  • Module-local use and import declarations now apply only to their own module. Named captures and inline HEEx retain lexical aliases and import

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[nelsonic]

Superseded by #231

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.