chore(deps): bump the elixir-minor group with 2 updates

[dependabot]

Bumps the elixir-minor group with 2 updates: bandit and phoenix.

Updates bandit from 1.12.4 to 1.12.5

Changelog

Sourced from bandit's changelog.

1.12.5 (20 Aug 2026)

Changes

• Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532w-jv94) (#671)
• Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings (#665)
• Treat proxy-connection as a connection-specific header in HTTP/2 (#632)
• Return FRAME_SIZE_ERROR for HEADERS/DATA frames too short for their flags (#652)
• Treat abortive-close posix reasons as client closures in logging (#663)

Fixes

• Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) (#670)
• Use PROTOCOL_ERROR for a zero WINDOW_UPDATE increment (#656)
• Reject send_file ranges past EOF instead of emitting a negative Content-Length (#653)
• Reject compressed WebSocket control frames regardless of the fin bit (#651)
• Enforce the RFC9112 chunk-size grammar and reject repeated transfer-encoding (#631)
• Fix typos (#627)
• Fix non-deterministic compile-time code (#646)

Enhancements

• Lazily precompile the invalid-field-value match pattern (#662)
• Add tests for untested configuration options (#659)
• Match the weak-etag prefix W/ explicitly (#657)
• Do not duplicate an existing vary: accept-encoding header (#658)
• Honor the close/keep-alive token inside a comma-separated Connection header (#655)
• Initialize the per-stream receive window from the advertised initial_window_size (#654)
• Keep track of body_length to avoid list iterations (#645)
• Avoid per-header length/1 and option lookups in do_read_headers! (#614) (#626)

Commits

• 9571499 Version bump to 1.12.5
• f6914aa Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532...
• d38cf04 Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) (#670)
• cce7c5f Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings (#...
• eca1713 Fixup recent test noise
• b65c235 Consolidate Plug.Conn.Adapter calling-process tests into adapter_test.exs (#667)
• 4ccc008 Treat abortive-close posix reasons as client closures in logging (#663)
• 274eb55 Lazily precompile the invalid-field-value match pattern (#662)
• 10710de Enforce the chunk-size grammar in a single pass (#661)
• d69202e Unify case-insensitive comma-separated header token checks (#660)
• Additional commits viewable in compare view

Updates phoenix from 1.8.11 to 1.8.12

Release notes

Sourced from phoenix's releases.

v1.8.12

Bug fixes

• [phx.gen.auth] Fix return_to session key not being cleared after logging in (#6798)
• [Channels] Fix channel messages being invalidly dropped when receiving messages without a join_ref (introduced in 1.8.3) (#6800)

Changelog

Sourced from phoenix's changelog.

v1.8.12 (2026-08-20)

Bug fixes

• [phx.gen.auth] Fix return_to session key not being cleared after logging in (#6798)
• [Channels] Fix channel messages being invalidly dropped when receiving messages without a join_ref (introduced in 1.8.3) (#6800)

Commits

• a27a032 Release v1.8.12
• 11e30af Clear :return_to session key after logging in (#6799)
• a2bda2d join_ref can be nil on non-join messages (#6800)
• ce109c9 Fix release date for v1.8.11 (#6795)
• 7e9fb23 update deps
• 3765e81 Add markdown formatter to docs output (#6794)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR updates the 'elixir-minor' dependency group, bumping 'bandit' to 1.12.5 and 'phoenix' to 1.8.12. These updates address security vulnerabilities in HTTP/2 and resolve bugs in Phoenix session management and channels.

Codacy analysis indicates that the changes are up to standards. However, there is an implementation gap in terms of verification; the PR metadata does not confirm that the application's test suite has been successfully run against these specific dependency versions to ensure no regressions were introduced by the minor/patch updates.

About this PR

• No verification steps or test results were provided to confirm that the minor/patch updates for 'bandit' and 'phoenix' do not break existing functionality. It is recommended to verify the test suite passes in a CI environment or locally before merging.

Test suggestions

• Verify that the 'mix.lock' file has been updated to the specific versions 1.12.5 and 1.8.12.
• Run the application's test suite to ensure compatibility with the updated dependency versions.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the 'mix.lock' file has been updated to the specific versions 1.12.5 and 1.8.12.
2. Run the application's test suite to ensure compatibility with the updated dependency versions.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[hyperpolymath]

Approved by Antigravity

[hyperpolymath]

Approved by Antigravity