Skip to content

fix(deps): bump the mix-production group across 1 directory with 11 updates - #215

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/mix-production-bfd9e9b122
Closed

fix(deps): bump the mix-production group across 1 directory with 11 updates#215
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/mix-production-bfd9e9b122

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the mix-production group with 7 updates in the / directory:

Package From To
ash 3.31.0 3.31.3
ash_postgres 2.11.0 2.12.0
commanded 1.4.10 1.4.11
mdex 0.13.4 0.13.5
oban 2.23.0 2.23.1
phoenix_live_dashboard 0.8.7 0.9.0
swoosh 1.26.3 1.27.1

Updates ash from 3.31.0 to 3.31.3

Release notes

Sourced from ash's releases.

v3.31.3

Bug Fixes:

fix for CVE-2026-67579

  • switch docs & installer to use actual name for config by @​zachdaniel

v3.31.2

Bug Fixes:

  • undo breaking change where we started honoring :allow_forbidden_field_for_relationships_by_default? by @​zachdaniel

v3.31.1

Bug Fixes:

... (truncated)

Changelog

Sourced from ash's changelog.

v3.31.3 (2026-08-12)

Bug Fixes:

fix for CVE-2026-67579

  • switch docs & installer to use actual name for config by @​zachdaniel

v3.31.2 (2026-08-09)

Bug Fixes:

  • undo breaking change where we started honoring :allow_forbidden_field_for_relationships_by_default? by @​zachdaniel

v3.31.1 (2026-08-09)

Bug Fixes:

... (truncated)

Commits
  • 2632fdf chore: release version v3.31.3
  • 91874dd fix: do not accept any %Ash.Expr{} terms via keysets
  • e5370fc fix: switch docs & installer to use actual name for config
  • e54eb0a chore: release version v3.31.2
  • e290532 fix: undo breaking change where we started honoring `:allow_forbidden_field_f...
  • f3725ff chore: release version v3.31.1
  • 1816b10 fix: limit keyset binary size
  • 09f4259 fix: sanitize managed relationship lookup filters
  • a402859 fix: resolve bulk index from changeset in after_batch filter (#2842)
  • 0859b17 fix(ci): pass --all to mix igniter.upgrade (#2841)
  • Additional commits viewable in compare view

Updates ash_postgres from 2.11.0 to 2.12.0

Release notes

Sourced from ash_postgres's releases.

v2.12.0

Features:

  • add match_tenant? option for attribute multitenancy FKs (#813) by TravelCurry02

  • add after_tables to custom_statements so raw SQL can depend on another table (#799) by Jechol Lee

Improvements:

  • replace pairwise operation ordering with a dependency-graph topological sort (#798) by Jechol Lee

Bug Fixes:

  • return upsert identity keys and correlate on the full key set so bulk upserts don't drop by Daniel Gollings

  • clean up obsolete serial sequences (#806) by Jechol Lee

  • fix ordering constraints for composite primary keys by Zach Daniel

Changelog

Sourced from ash_postgres's changelog.

v2.12.0 (2026-08-14)

Features:

  • add match_tenant? option for attribute multitenancy FKs (#813) by TravelCurry02

  • add after_tables to custom_statements so raw SQL can depend on another table (#799) by Jechol Lee

Improvements:

  • replace pairwise operation ordering with a dependency-graph topological sort (#798) by Jechol Lee

Bug Fixes:

  • return upsert identity keys and correlate on the full key set so bulk upserts don't drop by Daniel Gollings

  • clean up obsolete serial sequences (#806) by Jechol Lee

  • fix ordering constraints for composite primary keys by Zach Daniel

Commits
  • ea463a2 chore: release version v2.12.0
  • deea7b8 chore: add tests for the Duration form of the datetime expressions (#814)
  • 21f696e chore: generate migrations
  • 2c12145 feat: add match_tenant? option for attribute multitenancy FKs (#813)
  • 4e6dfd9 chore: update deps & add tests
  • 9ecd4fd fix: return upsert identity keys and correlate on the full key set so bulk up...
  • 8d75c27 test: cover the order combination parts are applied in (#811)
  • fc165f3 chore(deps): bump the production-dependencies group with 2 updates (#810)
  • d059a44 chore: fix spdx
  • 2707a5c chore: licenses
  • Additional commits viewable in compare view

Updates commanded from 1.4.10 to 1.4.11

Release notes

Sourced from commanded's releases.

v1.4.11

What's Changed

New Contributors

Full Changelog: commanded/commanded@v.1.4.10...v1.4.11

Changelog

Sourced from commanded's changelog.

v1.4.11

Bug fixes

Commits

Updates mdex from 0.13.4 to 0.13.5

Release notes

Sourced from mdex's releases.

v0.13.5

0.13.5 (2026-07-29)

Bug Fixes

  • LiveView 1.2 deprecation warnings( EEx.compile ) (#380) (b4c8247)
  • relax phoenix_live_view version (572d30d)
Changelog

Sourced from mdex's changelog.

0.13.5 (2026-07-29)

Bug Fixes

Commits
  • a6099c4 chore(main): release 0.13.5 (#383)
  • c0e9523 chore(deps): bump lumis from 0.6.2 to 0.6.3 (#385)
  • 08239b0 chore(deps): bump phoenix_live_view from 1.2.7 to 1.2.8 (#384)
  • 572d30d fix: relax phoenix_live_view version
  • b4c8247 fix: LiveView 1.2 deprecation warnings( EEx.compile ) (#380)
  • See full diff in compare view

Updates oban from 2.23.0 to 2.23.1

Changelog

Sourced from oban's changelog.

v2.23.1 - 2026-08-02

Bug Fixes

  • [Peer] Scope lease renewal to the owning node

    Leadership renewal matched the peers row by name alone, so a node that lost its lease renewed whichever row it found and concluded it was still the leader. The belief never corrected, letting a second node run Cron and insert duplicate jobs until restart.

    Renewal is now scoped to the row's owner, so a peer that lost the lease demotes at the next election. Failed elections concede leadership rather than retaining it, and no longer crash the peer.

  • [Producer] Dispatch on refresh for missed notifications

    When an insert notification is dropped a queue could sit idle until it was manually paused and resumed. Producers now attempt a dispatch on each refresh, so a stuck queue self-heals on the next cycle. The default refresh_interval is now 60s (was 30s), since it purely controls recovery time.

  • [Job] Set successful state as default unique options

    Use the complete successful group as the unique default so it includes the suspended state.

  • [Reindexer] Reindex every configured index even when one fails

    A single missing or invalid index previously halted the entire reindex run, silently skipping every index after it. Each reindex is now independent, and failures are aggregated into the run's telemetry error metadata, identifying exactly which queries failed.

  • [Migration] Fix custom migrator resolution

    Use the repo selected from opts[:repo] when resolving a configured custom migrator.

Commits
  • f86cc92 Release v2.23.1
  • 7d96854 Scope peer lease renewal to the owning node
  • f92c53e Dispatch on refresh for missed notifications
  • 581bdcb Expand unique state groups for unique: true
  • 52cd08e Fix custom migrator resolution (#1483)
  • a772915 Set successful state in default unique options (#1463)
  • 4e06067 Reindex every configured index even when one fails
  • See full diff in compare view

Updates phoenix from 1.8.9 to 1.8.11

Release notes

Sourced from phoenix's releases.

v1.8.11

Bug fixes

  • Fix Phoenix crashing on boot if Mix is available, but not started (#6789)

v1.8.10

Bug fixes

  • [Phoenix.CodeReloader] Fix "must restart your server" messages from code reloader when compile.lock mtime changes without a content change (#6753)
  • [Phoenix.Endpoint] add missing websocket options (#6758)
  • [phoenix.js] Close and retry the longpoll transport when a batch POST times out (#6769)
  • [phoenix.js] Release the stale reply binding of a buffered push (#6788)

Enhancements

  • [phx.gen.release] Use Bob API to find Docker images in phx.gen.release --docker
  • [Channels] Allow LongPoll transport token to be sent in header (this will change in 1.9)
  • [Phoenix.Router] Support plugs with options in pipe_throught (#6755)
  • [Phoenix.Token] document encode options (see the change in plug_crypto)
  • [phoenix.js] Ensure transport errors are identifiable (#6763)
Changelog

Sourced from phoenix's changelog.

v1.8.11 (2028-08-12)

Bug fixes

  • Fix Phoenix crashing on boot if Mix is available, but not started (#6789)

v1.8.10 (2026-08-10)

Bug fixes

  • [Phoenix.CodeReloader] Fix "must restart your server" messages from code reloader when compile.lock mtime changes without a content change (#6753)
  • [Phoenix.Endpoint] add missing websocket options (#6758)
  • [phoenix.js] Close and retry the longpoll transport when a batch POST times out (#6769)
  • [phoenix.js] Release the stale reply binding of a buffered push (#6788)

Enhancements

  • [phx.gen.release] Use Bob API to find Docker images in phx.gen.release --docker
  • [Channels] Allow LongPoll transport token to be sent in header (this will change in 1.9)
  • [Phoenix.Router] Support plugs with options in pipe_throught (#6755)
  • [Phoenix.Token] document encode options (see the change in plug_crypto)
  • [phoenix.js] Ensure transport errors are identifiable (#6763)
Commits
  • a986654 Release v1.8.11
  • 51121f3 fix starting phoenix with mix available but not started (#6790)
  • 109aacd Release v1.8.10
  • c6c1761 Update assets
  • 9f92654 release the stale reply binding of a buffered push (#6788)
  • 5351c74 Improve transport docs
  • 5dca4ed Make pipe_through accepts pipelines and all plug forms (#6760)
  • 127f545 Include per-mount :check_origin in the origin policy cache key (#6774)
  • b6b77e4 Close and retry the longpoll transport when a batch POST times out (#6769)
  • 8e69e9c Fix broken doc reference in Phoenix.Debug (#6772)
  • Additional commits viewable in compare view

Updates phoenix_live_dashboard from 0.8.7 to 0.9.0

Changelog

Sourced from phoenix_live_dashboard's changelog.

v0.9.0 (2026-08-12)

  • Require Phoenix LiveView 1.0+
  • Require Elixir 1.15+
  • Add a compact nested list view for application supervision trees
  • Allow overriding the Ecto Stats info module per repository by passing {repo, info_module} tuples in :ecto_repos
  • Add refresh_interval as a reporting option for chart components
  • Display process label in application and process views
Commits

Updates phoenix_live_view from 1.2.8 to 1.2.9

Release notes

Sourced from phoenix_live_view's releases.

v1.2.9

Security fixes

  • CVE-2026-64941: Fix open redirect in redirect/2 via ASCII tab, LF and CR

Bug fixes

  • Fix live components being wrongly destroyed in some rare cases (#4350)
  • Ensure parent navigation succeeds with a blocked child (#4359)

Enhancements

  • Add internal debug tooling to customize clientside rendering (#4364)
Changelog

Sourced from phoenix_live_view's changelog.

v1.2.9 (2026-08-10)

Security fixes

  • CVE-2026-64941: Fix open redirect in redirect/2 via ASCII tab, LF and CR

Bug fixes

  • Fix live components being wrongly destroyed in some rare cases (#4350)
  • Ensure parent navigation succeeds with a blocked child (#4359)

Enhancements

  • Add internal debug tooling to customize clientside rendering (#4364)
Commits

Updates postgrex from 0.22.3 to 0.22.4

Changelog

Sourced from postgrex's changelog.

v0.22.4 (2026-08-07)

  • Security
    • Escape comments on Postgrex.stream/4 (CVE-2026-66838)
Commits

Updates req from 0.7.1 to 0.7.3

Release notes

Sourced from req's releases.

v0.7.3

  • encode_body: Revert "Automatically change GET to POST when request body is set."

v0.7.2

  • encode_body: Bring back form_multipart: [{string_name, value}].
  • put_aws_sigv4: Fix AWS SigV4 compatibility with Supabase Storage S3.
Changelog

Sourced from req's changelog.

v0.7.3 (2026-08-19)

v0.7.2 (2026-07-31)

  • encode_body: Bring back form_multipart: [{string_name, value}].
  • [put_aws_sigv4]: Fix AWS SigV4 compatibility with Supabase Storage S3.
Commits
  • 2901181 Release v0.7.3
  • e857078 Revert "encode_body: Automatically change GET to POST when request body is ...
  • c136357 Release v0.7.2
  • e9d4ebc Fix AWS SigV4 compatibility with Supabase Storage S3 (#498)
  • See full diff in compare view

Updates swoosh from 1.26.3 to 1.27.1

Release notes

Sourced from swoosh's releases.

v1.27.1 🚀

🐛 Bug Fixes

⛓️ Dependency

New Contributors

Full Changelog: swoosh/swoosh@v1.27.0...1.27.1

v1.27.0 🚀

✨ Features

📝 Documentation

New Contributors

Full Changelog: swoosh/swoosh@v1.26.3...v1.27.0

Changelog

Sourced from swoosh's changelog.

1.27.1

🐛 Bug Fixes

  • Fix Swoosh.Adapters.AmazonSES crashing when the SES error response XML is missing an expected node @​youdie006 (#1186)

1.27.0

✨ Features

Commits
  • ffa34f6 build(deps): bump cowboy from 2.17.0 to 2.18.0 (#1180)
  • 90f66ec build(deps): bump hackney from 4.5.2 to 4.7.3 (#1187)
  • 650150c Prepare 1.27.1 patch release files
  • 3cfbd09 Return empty text for a missing XML node instead of crashing (#1186)
  • ea6fca1 build(deps): bump req from 0.6.2 to 0.7.2 (#1183)
  • ae80fbe Prepare 1.27.0 minor release files
  • 96345a9 docs: flag EU-exclusive and GDPR-only adapters in the README
  • f6e1b52 Add AhaSend adapter (#1177)
  • e937dbb build(deps): bump plug_cowboy from 2.8.1 to 2.9.0 (#1168)
  • 16e8b0f build(deps): bump cowboy from 2.16.1 to 2.17.0 (#1170)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
fix(deps): bump the mix-production group across 1 directory with 11 u…
adeec14 
…pdates

Bumps the mix-production group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [ash](https://github.com/ash-project/ash) | `3.31.0` | `3.31.3` |
| [ash_postgres](https://github.com/ash-project/ash_postgres) | `2.11.0` | `2.12.0` |
| [commanded](https://github.com/commanded/commanded) | `1.4.10` | `1.4.11` |
| [mdex](https://github.com/leandrocp/mdex) | `0.13.4` | `0.13.5` |
| [oban](https://github.com/oban-bg/oban) | `2.23.0` | `2.23.1` |
| [phoenix_live_dashboard](https://github.com/phoenixframework/phoenix_live_dashboard) | `0.8.7` | `0.9.0` |
| [swoosh](https://github.com/swoosh/swoosh) | `1.26.3` | `1.27.1` |



Updates `ash` from 3.31.0 to 3.31.3
- [Release notes](https://github.com/ash-project/ash/releases)
- [Changelog](https://github.com/ash-project/ash/blob/main/CHANGELOG.md)
- [Commits](ash-project/ash@v3.31.0...v3.31.3)

Updates `ash_postgres` from 2.11.0 to 2.12.0
- [Release notes](https://github.com/ash-project/ash_postgres/releases)
- [Changelog](https://github.com/ash-project/ash_postgres/blob/main/CHANGELOG.md)
- [Commits](ash-project/ash_postgres@v2.11.0...v2.12.0)

Updates `commanded` from 1.4.10 to 1.4.11
- [Release notes](https://github.com/commanded/commanded/releases)
- [Changelog](https://github.com/commanded/commanded/blob/main/CHANGELOG.md)
- [Commits](commanded/commanded@v.1.4.10...v1.4.11)

Updates `mdex` from 0.13.4 to 0.13.5
- [Release notes](https://github.com/leandrocp/mdex/releases)
- [Changelog](https://github.com/leandrocp/mdex/blob/main/CHANGELOG.md)
- [Commits](leandrocp/mdex@v0.13.4...v0.13.5)

Updates `oban` from 2.23.0 to 2.23.1
- [Release notes](https://github.com/oban-bg/oban/releases)
- [Changelog](https://github.com/oban-bg/oban/blob/v2.23.1/CHANGELOG.md)
- [Commits](oban-bg/oban@v2.23.0...v2.23.1)

Updates `phoenix` from 1.8.9 to 1.8.11
- [Release notes](https://github.com/phoenixframework/phoenix/releases)
- [Changelog](https://github.com/phoenixframework/phoenix/blob/v1.8.11/CHANGELOG.md)
- [Commits](phoenixframework/phoenix@v1.8.9...v1.8.11)

Updates `phoenix_live_dashboard` from 0.8.7 to 0.9.0
- [Release notes](https://github.com/phoenixframework/phoenix_live_dashboard/releases)
- [Changelog](https://github.com/phoenixframework/phoenix_live_dashboard/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/phoenix_live_dashboard@v0.8.7...v0.9.0)

Updates `phoenix_live_view` from 1.2.8 to 1.2.9
- [Release notes](https://github.com/phoenixframework/phoenix_live_view/releases)
- [Changelog](https://github.com/phoenixframework/phoenix_live_view/blob/main/CHANGELOG.md)
- [Commits](phoenixframework/phoenix_live_view@v1.2.8...v1.2.9)

Updates `postgrex` from 0.22.3 to 0.22.4
- [Release notes](https://github.com/elixir-ecto/postgrex/releases)
- [Changelog](https://github.com/elixir-ecto/postgrex/blob/master/CHANGELOG.md)
- [Commits](elixir-ecto/postgrex@v0.22.3...v0.22.4)

Updates `req` from 0.7.1 to 0.7.3
- [Release notes](https://github.com/wojtekmach/req/releases)
- [Changelog](https://github.com/wojtekmach/req/blob/main/CHANGELOG.md)
- [Commits](wojtekmach/req@v0.7.1...v0.7.3)

Updates `swoosh` from 1.26.3 to 1.27.1
- [Release notes](https://github.com/swoosh/swoosh/releases)
- [Changelog](https://github.com/swoosh/swoosh/blob/main/CHANGELOG.md)
- [Commits](swoosh/swoosh@v1.26.3...1.27.1)

---
updated-dependencies:
- dependency-name: ash
  dependency-version: 3.31.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-production
- dependency-name: ash_postgres
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-production
- dependency-name: commanded
  dependency-version: 1.4.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-production
- dependency-name: mdex
  dependency-version: 0.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-production
- dependency-name: oban
  dependency-version: 2.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-production
- dependency-name: phoenix
  dependency-version: 1.8.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-production
- dependency-name: phoenix_live_dashboard
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-production
- dependency-name: phoenix_live_view
  dependency-version: 1.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-production
- dependency-name: postgrex
  dependency-version: 0.22.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-production
- dependency-name: req
  dependency-version: 0.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mix-production
- dependency-name: swoosh
  dependency-version: 1.27.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mix-production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 27, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 27, 2026
@dependabot
dependabot Bot deleted the dependabot/hex/mix-production-bfd9e9b122 branch August 27, 2026 12:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants