build(deps-dev): bump the dev-dependencies group with 4 updates

[dependabot]

Bumps the dev-dependencies group with 4 updates: bandit, dialyxir, ex_doc and req.

Updates bandit from 1.12.4 to 1.12.5

Changelog

Sourced from bandit's changelog.

1.12.5 (20 Aug 2026)

Changes

• Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532w-jv94) (#671)
• Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings (#665)
• Treat proxy-connection as a connection-specific header in HTTP/2 (#632)
• Return FRAME_SIZE_ERROR for HEADERS/DATA frames too short for their flags (#652)
• Treat abortive-close posix reasons as client closures in logging (#663)

Fixes

• Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) (#670)
• Use PROTOCOL_ERROR for a zero WINDOW_UPDATE increment (#656)
• Reject send_file ranges past EOF instead of emitting a negative Content-Length (#653)
• Reject compressed WebSocket control frames regardless of the fin bit (#651)
• Enforce the RFC9112 chunk-size grammar and reject repeated transfer-encoding (#631)
• Fix typos (#627)
• Fix non-deterministic compile-time code (#646)

Enhancements

• Lazily precompile the invalid-field-value match pattern (#662)
• Add tests for untested configuration options (#659)
• Match the weak-etag prefix W/ explicitly (#657)
• Do not duplicate an existing vary: accept-encoding header (#658)
• Honor the close/keep-alive token inside a comma-separated Connection header (#655)
• Initialize the per-stream receive window from the advertised initial_window_size (#654)
• Keep track of body_length to avoid list iterations (#645)
• Avoid per-header length/1 and option lookups in do_read_headers! (#614) (#626)

Commits

• 9571499 Version bump to 1.12.5
• f6914aa Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532...
• d38cf04 Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) (#670)
• cce7c5f Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings (#...
• eca1713 Fixup recent test noise
• b65c235 Consolidate Plug.Conn.Adapter calling-process tests into adapter_test.exs (#667)
• 4ccc008 Treat abortive-close posix reasons as client closures in logging (#663)
• 274eb55 Lazily precompile the invalid-field-value match pattern (#662)
• 10710de Enforce the chunk-size grammar in a single pass (#661)
• d69202e Unify case-insensitive comma-separated header token checks (#660)
• Additional commits viewable in compare view

Updates dialyxir from 1.4.7 to 1.4.8

Release notes

Sourced from dialyxir's releases.

1.4.8

Added

• Add support for the OTP 28 warnings :exact_compare, :opaque_compare, and :opaque_union.

Fixed

• Handle line-and-column locations when matching line-specific warning ignores.

Changed

• Update ExDoc to 0.40.3 to generate Markdown documentation and llms.txt.

Docs

• Clarify the output and intended use of the ignore_file and ignore_file_strict formatters.

Changelog

Sourced from dialyxir's changelog.

Unreleased changes post [1.4.8]

[1.4.8] - 2026-09-05

Added

• Add support for the OTP 28 warnings :exact_compare, :opaque_compare, and :opaque_union.

Fixed

• Handle line-and-column locations when matching line-specific warning ignores.

Changed

• Update ExDoc to 0.40.3 to generate Markdown documentation and llms.txt.

Docs

• Clarify the output and intended use of the ignore_file and ignore_file_strict formatters.

Commits

• 13bcb7d Release 1.4.8
• 4a2b6d7 Merge pull request #584 from lud-wj/fix/ignoring-by-line
• a2a4361 Merge branch 'master' into fix/ignoring-by-line
• 31a4cd8 Merge pull request #601 from BobbieBarker/docs/exdoc-0.40
• 6ba7b38 Update ExDoc to 0.40.3
• 3553678 Add OTP 28 warning support: exact_compare, opaque_compare, opaque_union (#591)
• 19dd690 Merge pull request #597 from dl-alexandre/codex/clarify-ignore-file-format
• f12db01 clarify ignore file formatter docs
• cdcea96 fix: Fixed dialyzer ignore by line for warnings with line/col
• 9fbbaf5 update changelog
• See full diff in compare view

Updates ex_doc from 0.40.3 to 0.40.4

Changelog

Sourced from ex_doc's changelog.

v0.40.4 (2026-09-03)

• Enhancements

  • Add :api_reference_noindex option to keep search engines from indexing api-reference.html
  • Generate reproducible HTML and EPUB output
  • Link HexDocs packages through their per-package subdomains

• Bug fixes

  • Preserve in-page anchors during Swup navigation and fully reload navigation between ExDoc builds
  • Format Elixir specs consistently regardless of their source line numbers
  • Autolink the Erlang/OTP 29 built-in record/0 type
  • Fix focus outline positioning for top-content heading action icons

Commits

• 80270f3 Release v0.40.4
• 934cf54 Reference to missing section (#2264)
• b5679af Add license information for remixicon font (#2263)
• 850f709 Bump brace-expansion from 1.1.12 to 1.1.18 in /assets (#2261)
• 873e03e Bump postcss from 8.5.15 to 8.5.26 in /assets (#2259)
• 27660d3 Bump js-yaml from 4.2.0 to 4.3.1 in /assets (#2260)
• ffec214 Bump postcss from 8.5.6 to 8.5.15 in /assets (#2241)
• 23cbd23 epub: Honor SOURCE_DATE_EPOCH for dcterms:modified and dc:identifier (#2256)
• a37128a Use a fixed makeup group_prefix for reproducible HTML output (#2255)
• 01f4763 Update earmark_parser dependency version -> 1.4.46 (#2254)
• Additional commits viewable in compare view

Updates req from 0.7.2 to 0.7.4

Release notes

Sourced from req's releases.

v0.7.4

• put_params: Allow explicit duplicates.

  in v0.7.0 we made this change:

  Overwrite existing query params instead of appending.

  This was a regression for legitimate use cases where some servers require duplicate params. Now we allow explicit duplicates but otherwise overwrite any previously set:

  Req.get!("?id=1&foo=bar", params: [id: 2, id: 3]) # ?id=2&id=3&foo=bar
  

• put_path_params: Do not overwrite redirect target.

v0.7.3

• encode_body: Revert "Automatically change GET to POST when request body is set."

Changelog

Sourced from req's changelog.

v0.7.4 (2026-08-26)

• [put_params]: Allow explicit duplicates.

  in v0.7.0 we made this change:

  Overwrite existing query params instead of appending.

  This was a regression for legitimate use cases where some servers require duplicate params. Now we allow explicit duplicates but otherwise overwrite any previously set:

  Req.get!("?id=1&foo=bar", params: [id: 2, id: 3]) # ?id=2&id=3&foo=bar
  

• [put_path_params]: Do not overwrite redirect target.

v0.7.3 (2026-08-19)

Commits

• 3678dc4 Release v0.7.4
• bd160b2 put_path_params: Do not overwrite redirect target, closes #562
• 9b7330f put_params: Preserve order
• b099a12 put_params: Allow explicit duplicate param names
• 2901181 Release v0.7.3
• e857078 Revert "encode_body: Automatically change GET to POST when request body is ...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[maxekman]

@dependabot rebase

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.