[dependabot]

Bumps the all-dependencies group with 3 updates: ash, mix_test_interactive and sobelow.

Updates ash from 3.37.1 to 3.37.2

Release notes

Sourced from ash's releases.

v3.37.2

Bug Fixes:

• don't crash a bulk create when an upsert it runs singly is skipped by @​zachdaniel

• [security] scope upserts to the tenant under attribute multitenancy (CVE-2026-96581, GHSA-vw7c-67pf-gh96) by @​zachdaniel

Changelog

Sourced from ash's changelog.

v3.37.2 (2026-10-26)

Bug Fixes:

• don't crash a bulk create when an upsert it runs singly is skipped by @​zachdaniel

• [security] scope upserts to the tenant under attribute multitenancy (CVE-2026-96581, GHSA-vw7c-67pf-gh96) by @​zachdaniel

Commits

• a8c62e2 chore: release version v3.37.2
• b6bf308 fix: don't crash a bulk create when an upsert it runs singly is skipped
• c9f0cdb fix: scope upserts to the tenant under attribute multitenancy
• ca0c44a docs: reference the CVEs fixed in the last release
• See full diff in compare view

Updates mix_test_interactive from 5.2.0 to 6.0.0

Release notes

Sourced from mix_test_interactive's releases.

v6.0.0

💥 BREAKING CHANGES 💥

• In this release, we eliminate interactions between commands. Previously, you could only have one of the (s)tale, (f)ailed, or (p)attern options enabled at the same time. We now eliminate that restriction, so you can now run all stale tests matching a filename pattern, for example. Note that mix test itself currently does not allow --failed and --stale to be provided together, but we don't implement that restriction in mix test.interactive. Instead, we allow mix test to report the issue itself. (#155, #158, #159)
• The (a)ll tests command now also clears any (i)nclude, e(x)clude, or (o)nly tags in addition to clearing the (s)tale, (f)ailed, and (p)attern options. (#155)
• We change how we process the arguments to interactive commands. In order to properly support filename patterns, tags, and name patterns that might have embedded spaces or other special characters, we now respect quoting of the arguments using single- or double-quotes, or backslash escapes before whitespace characters. While this is an improvement in functionality, it is a change to how argument parsing used to work. (#162)
• We are now strict about the number of arguments passed to the various commands. Previously, some commands would accept any number of arguments while others would crash and restart the interactive loop when given the wrong number of arguments. We now report an error when any command is given an incorrect number of arguments and no longer crash. (#163)
• We remove most of the modules from the public API, leaving only the mix task, the TestRunner behaviour and the Config struct that is used by that behaviour. This library is primarily intended as a mix task and there should be no need to interact with its internals. (#164)
• This release drops support for Elixir 1.14 and 1.15. We officially support the same versions as Elixir itself, so support for Elixir 1.14 and 1.15 is no longer provided. (#156)

Updated

• (Elixir 1.19 and above) We now support and allow adjustments to the new -n/--name-pattern option to mix test. You can specify a name pattern on the command line when starting mix test.interactive. You can later use the n <name pattern> command to specify or change the name pattern or the n command to clear the name pattern. Name patterns allow you to run only tests whose names match the pattern. These are similar to the filename patterns we already supported (via the p command), which do the same kind of matching on test filenames. We update the API and documentation to better distinguish between filename patterns and (test) name patterns. (#160, #161)
• We now recognize the --max-requires (Elixir 1.18 and later) and --dry-run (Elixir 1.19 and later) command-line options and pass them along to mix test on every test run. We do not support managing them via mix test.interactive commands, however. (#157)
• We now allow the --failed or --stale options to co-exist with filename patterns as well as name patterns and tags. See above for more details. (#155, #158, #159)
• The (a)ll tests command now also clears any (i)nclude, e(x)clude, or (o)nly tags in addition to clearing the (s)tale, (f)ailed, and (p)attern options. (#155)
• We now respect quoting of command arguments using single- or double-quotes, or backslash escapes before whitespace characters. See above for more details. (#162)

Bug Fixes

• We no longer crash when additional arguments are passed to commands which only allow a single argument. See above for more details. (#163)

Changelog

Sourced from mix_test_interactive's changelog.

v6.0.0 - 2026-10-05

💥 BREAKING CHANGES 💥

• In this release, we eliminate interactions between commands. Previously, you could only have one of the (s)tale, (f)ailed, or (p)attern options enabled at the same time. We now eliminate that restriction, so you can now run all stale tests matching a filename pattern, for example. Note that mix test itself currently does not allow --failed and --stale to be provided together, but we don't implement that restriction in mix test.interactive. Instead, we allow mix test to report the issue itself. (#155, #158, #159)
• The (a)ll tests command now also clears any (i)nclude, e(x)clude, or (o)nly tags in addition to clearing the (s)tale, (f)ailed, and (p)attern options. (#155)
• We change how we process the arguments to interactive commands. In order to properly support filename patterns, tags, and name patterns that might have embedded spaces or other special characters, we now respect quoting of the arguments using single- or double-quotes, or backslash escapes before whitespace characters. While this is an improvement in functionality, it is a change to how argument parsing used to work. (#162)
• We are now strict about the number of arguments passed to the various commands. Previously, some commands would accept any number of arguments while others would crash and restart the interactive loop when given the wrong number of arguments. We now report an error when any command is given an incorrect number of arguments and no longer crash. (#163)
• We remove most of the modules from the public API, leaving only the mix task, the TestRunner behaviour and the Config struct that is used by that behaviour. This library is primarily intended as a mix task and there should be no need to interact with its internals. (#164)
• This release drops support for Elixir 1.14 and 1.15. We officially support the same versions as Elixir itself, so support for Elixir 1.14 and 1.15 is no longer provided. (#156)

Updated

• (Elixir 1.19 and above) We now support and allow adjustments to the new -n/--name-pattern option to mix test. You can specify a name pattern on the command line when starting mix test.interactive. You can later use the n <name pattern> command to specify or change the name pattern or the n command to clear the name pattern. Name patterns allow you to run only tests whose names match the pattern. These are similar to the filename patterns we already supported (via the p command), which do the same kind of matching on

... (truncated)

Commits

• 5bf6f42 🏷️ Prepare v6.0.0 release (#165)
• cddc405 💥 Limit the documented API to custom runners (#164)
• aa48424 🐛 Reject the wrong number of arguments to interactive commands (#163)
• 33025a1 ✨ Support shell-style quoting in interactive commands (#162)
• cc5419f ✨ Support selecting tests by name pattern (#161)
• b67b802 💥 Use "filename pattern" terminology (#160)
• 60b1611 ✨ Summarize every active selection setting (#159)
• 0a94ee3 🐛 Honor --failed, --stale and filename patterns together at startup (#158)
• 7781110 👽 Add new mix test options (#157)
• 1b0b561 💥 Drop support for Elixir 1.14/1.15 (#156)
• Additional commits viewable in compare view

Updates sobelow from 0.16.0 to 0.18.0

Release notes

Sourced from sobelow's releases.

v0.18.0

• Enhancements

  • Add the Crypto category with WeakHash and WeakCipher checks for literal algorithm choices, including Erlang's streaming MD5 initializer.
  • Add Config.TLSVerify to report disabled TLS certificate verification in scanned source and production configuration, including both Hackney insecure option forms. Server and unknown SSL roles receive low confidence. TLS skip fingerprints include the original call AST.
  • Add DOS.Consult for dynamic file selection in :file.consult/1 and :file.path_consult/2, which can create atoms from untrusted term files.
  • Misc.BinToTerm reports Erlang calls with explicit :safe options at medium confidence instead of high, changing --exit high behavior. It also reports Plug's non-executable decoder without proven :safe. Existing finding IDs, source locations, and skip fingerprints are preserved.
  • Add RCE.File for dynamic file selection in Erlang eval and script APIs, including search paths, pipes and captures.
  • The new file-selection and cryptography checks resolve explicit Erlang imports, including pipes, captures and import arity restrictions.
  • Add DOS.ModuleConcat for dynamic module-name atom creation through Module.concat/1,2, including aliases, imports, pipes and captures.
  • Extend DOS.BinToAtom to interpolated atom word sigils (~w(...)a). Existing atom-interpolation findings, IDs and fingerprints are preserved.
  • Add RCE.Compile for dynamic source, ASTs and file selection in Code.compile_string, compile_quoted, compile_file and require_file.
  • Add Crypto.WeakSignature for explicit MD5 and SHA-1 digest selections in Erlang crypto and public-key signature APIs.
  • Add Config.WeakTLS for explicit legacy SSL, TLS and DTLS protocol selections, sharing source discovery, skips and TLS option parsing with Config.TLSVerify without changing existing TLS finding fingerprints.

• Bug fixes

  • Retain imported sinks in pipes without parentheses and parameter labels inside constructed ASTs. Qualified Kernel atom-word sigils are detected. These patterns can produce new findings; existing locations and skip fingerprints are unchanged.
  • TLS checks resolve explicit SSL and Hackney imports within their scope, retaining low confidence for imported SSL server calls. Literal TLS options and weak versions in cons lists and concatenations are retained.

What's Changed

• Add new checks from Jump fork by @​katafrakt in sobelow/sobelow#65
• Add atom construction, compilation, signature, and TLS checks by @​houllette in sobelow/sobelow#66
• Prepare v0.18.0 release by @​houllette in sobelow/sobelow#67

Full Changelog: sobelow/sobelow@v0.17.0...v0.18.0

v0.17.0

• Enhancements
  • DOS.ListToAtom now also reports :erlang.list_to_atom/1, including

... (truncated)

Changelog

Sourced from sobelow's changelog.

v0.18.0

• Enhancements

  • Add the Crypto category with WeakHash and WeakCipher checks for literal algorithm choices, including Erlang's streaming MD5 initializer.
  • Add Config.TLSVerify to report disabled TLS certificate verification in scanned source and production configuration, including both Hackney insecure option forms. Server and unknown SSL roles receive low confidence. TLS skip fingerprints include the original call AST.
  • Add DOS.Consult for dynamic file selection in :file.consult/1 and :file.path_consult/2, which can create atoms from untrusted term files.
  • Misc.BinToTerm reports Erlang calls with explicit :safe options at medium confidence instead of high, changing --exit high behavior. It also reports Plug's non-executable decoder without proven :safe. Existing finding IDs, source locations, and skip fingerprints are preserved.
  • Add RCE.File for dynamic file selection in Erlang eval and script APIs, including search paths, pipes and captures.
  • The new file-selection and cryptography checks resolve explicit Erlang imports, including pipes, captures and import arity restrictions.
  • Add DOS.ModuleConcat for dynamic module-name atom creation through Module.concat/1,2, including aliases, imports, pipes and captures.
  • Extend DOS.BinToAtom to interpolated atom word sigils (~w(...)a). Existing atom-interpolation findings, IDs and fingerprints are preserved.
  • Add RCE.Compile for dynamic source, ASTs and file selection in Code.compile_string, compile_quoted, compile_file and require_file.
  • Add Crypto.WeakSignature for explicit MD5 and SHA-1 digest selections in Erlang crypto and public-key signature APIs.
  • Add Config.WeakTLS for explicit legacy SSL, TLS and DTLS protocol selections, sharing source discovery, skips and TLS option parsing with Config.TLSVerify without changing existing TLS finding fingerprints.

• Bug fixes

  • Retain imported sinks in pipes without parentheses and parameter labels inside constructed ASTs. Qualified Kernel atom-word sigils are detected. These patterns can produce new findings; existing locations and skip fingerprints are unchanged.
  • TLS checks resolve explicit SSL and Hackney imports within their scope, retaining low confidence for imported SSL server calls. Literal TLS options and weak versions in cons lists and concatenations are retained.

v0.17.0

• Enhancements
  • DOS.ListToAtom now also reports :erlang.list_to_atom/1, including piped calls, matching how DOS.BinToAtom covers :erlang.binary_to_atom.
  • Add --only to run a chosen set of checks or categories, e.g. mix sobelow --only XSS.Raw,SQL. It takes the same names as --ignore, which still applies on top. Unknown names fail the run instead of scanning nothing. .sobelow-conf accepts only: and --save-config records it.

... (truncated)

Commits

• 225c794 Prepare v0.18.0 release
• 43d0cf8 Close adversarial gaps in security sink matching
• d167bc5 Normalize literal module names across supported Elixir releases
• 31496af Add Config.WeakTLS with shared TLS source and option traversal
• 7530d6a Add Crypto.WeakSignature for MD5 and SHA-1 signatures
• aa2b2a0 Add RCE.Compile for source compilation and file loading
• 45bbaf1 Detect interpolated atom word sigils without duplicating atom findings
• fa9b3d6 Add DOS.ModuleConcat for dynamic module-name atoms
• c745e4d Detect streaming Erlang MD5 and preserve zero-arity captures
• 448ca14 Harden TLS option detection, confidence, and skip identity
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions