chore(deps): update elixir minor updates

[wttj-bot]

This PR contains the following updates:

Package	Type	Update	Change	Pending
ecto (source)	prod	minor	3.13.6 → 3.14.2
ecto_sql (source)	dev	minor	3.13.5 → 3.14.0
faker (source)	dev	minor	~> 0.12 → ~> 0.19
req (source)	dev	minor	~> 0.5 → ~> 0.7	0.7.3
sobelow (source)	dev	minor	~> 0.13 → ~> 0.15

---

Release Notes

elixir-ecto/ecto (ecto)

v3.14.2

Compare Source

Enhancements

• [Ecto.Schema] Allow configuring :writable and :on_writable_violation for the :inserted_at field generated by timestamps/1

Bug fixes

• [Ecto.Changeset] Fix changed?/3 for removed one-to-one relations
• [Ecto.Changeset] Fix stale belongs_to keys in apply_changes/1
• [Ecto.Changeset] Preserve prepare_changes callbacks in merge/2
• [Ecto.Changeset] Preserve the default :on_cast function in relation type metadata
• [Ecto.Query] Fix source field caching for map updates
• [Ecto.Repo] Propagate the caller's Logger level to preload tasks
• [Ecto.Repo] Enforce writable fields after prepare_changes callbacks
• [Ecto.Schema] Fix autogeneration options for composite types
• [Ecto.Schema] Avoid compile-time dependencies on modules named in @derive
• [Ecto.Type] Normalize DateTime casts to UTC

v3.14.1

Compare Source

Enhancements

• [Ecto.Schema] Allow embedded_schema to have non-virtual :any fields
• [Ecto.Schema] Add :on_writable_violation option for fields (a default can be specified with @on_writable_violation)
• [Ecto.UUID] Add helper functions for UUIDv7

Bug fixes

• [Ecto.Query] Warn on parentheses in query field access
• [Ecto.Query] Expand macros in window frames
• [Ecto.Query] Fix data-modifying CTE planner cache traversal
• [Ecto.Query] Fix splice parameters in dynamic expressions
• [Ecto.Query] Fix subquery order in query builders
• [Ecto.Query] Fix wrong placeholder numbering when a from source is a {fragment, schema} tuple
• [Ecto.Repo] Do not reflect changes ignored due to :writable in returned struct
• [Ecto.Repo] Fix placeholder type mismatch check on insert_all with placeholders

v3.14.0

Compare Source

Enhancements

• [Ecto.Adapter] Accept a counter option in prepare_query/3
• [Ecto.Changeset] Add Ecto.Changeset.reorder_assoc/2
• [Ecto.Query] Allow from and joins with {fragment, Schema} source
• [Ecto.Repo] Raise an error on query-like keyword opts to Repo functions
• [Ecto.Repo] Support :replace_changed on upserts to enable HOT updates in PostgreSQL
• [Ecto.Repo] Add :query_cache option to selectively bypass query cache
• [Ecto.Schema] Add :on_join_through_conflict option for
• [Ecto.Type] Add Ecto.Type.trim/2 and allow developers to configure how values are trimmed on cast with the :trim_values option
• [Ecto.UUID] Support UUIDv7
• [mix.exs] Require decimal v3
• [mix ecto.create] Set timezone by default when creating new databases

Bug fixes

• [Ecto.Repo] Correctly extract passwords with colons from URL
• [Ecto.Repo] Redact repo config from SASL progress reports
• [Ecto.Repo] Preload custom queries with order_by now take precedence over :preload_order. The :preload_order option is now only applied when no custom query with ordering is provided.

elixir-ecto/ecto_sql (ecto_sql)

v3.14.0

Compare Source

Enhancements

• [migrations] Allow table modifiers such as UNLOGGED tables
• [migrations] Add Safe Ecto Migration guides
• [mysql] Support insert_mode: :ignore
• [postgres] Set a default timezone on mix ecto.create
• [sandbox] Label the sandbox owner process
• [sql] Allow fragment tuple sources in adapters
• [sql] Allow pid repos in Ecto.Adapters.SQL.table_exists?
• [sql] Accept counter option in to_sql/4
• [sql] Support {:unsafe_fragment, ...} support to RETURNING clause

elixirs/faker (faker)

v0.19.0

Compare Source

wojtekmach/req (req)

v0.7.2

Compare Source

• [encode_body]: Bring back form_multipart: [{string_name, value}].
  • [put_aws_sigv4]: Fix AWS SigV4 compatibility with Supabase Storage S3.

v0.7.1

Compare Source

• Deprecate cache: true/[cache] step. It will be removed in Req v0.8. I plan a comprehensive cache solution for Req v1.0+.

v0.7.0

Compare Source

• [Req]: Add Req.new(req, options).

  • [Req]: Treat URL userinfo as Basic Authentication.

  • [Req], [Req.Request]: Deprecate adapter: fun in favour of adapter: mod.

  • [Req.Request]: (BREAKING CHANGE) Remove current_request_steps field.

  • [Req.Request]: Fix redacting remaining auth values.

  • (BREAKING CHANGE) Replace run_finch step with [Req.Finch] adapter module.

  • (BREAKING CHANGE) Replace put_plug and run_plug steps with [Req.Plug] adapter module.

  • [Req.Finch]: Support finch: options.

  • [Req.Finch]: Support :request_timeout.

  • [Req.Finch]: Fix handling duplicate response headers.

  • [Req.Finch]: Deprecate finch: name in favour of finch: [name: name].

  • [Req.Finch]: Deprecate pool_timeout: value in favour of finch: [pool_timeout: value].

  • [Req.Finch]: Deprecate pool_max_idle_time: value in favour of finch: [pool_max_idle_time: value].

  • [Req.Finch]: Deprecate :finch_request.

  • [Req.Plug]: Handle individual response body chunks.

  • [Req.Plug]: Support non-UTF8 request params.

  • [Req.Plug]: Put original request private data in conn.private.

  • [Req.Test]: Allow descendant processes.

  • [Req.Test]: Fix concurrent plug fetches immediately after switching to shared mode.

  • [compress_body]: Do nothing when request content-encoding is already set.

  • [compress_body]: Update multipart boundary when re-running the step.

  • [compressed], [decode_body]: Replace optional ezstd dependency with Erlang/OTP 28+
    built-in :zstd.

  • [decode_body]: Deprecate :decode_json in favour of setting a custom JSON
    decoder via :decoders:

before:

    Req.get!(url, decode_json: [keys: :atoms])

after:

    Req.get!(url, decoders: [json: &Jason.decode(&1, keys: :atoms)])

• [encode_body]: (BREAKING CHANGE) Automatically change GET to POST when request body is set.

• [put_aws_sigv4]: Exclude accept-encoding, x-amzn-trace-id, and
  hop-by-hop headers from the signature.

• [put_aws_sigv4]: Correctly sign duplicate header values.

• [put_params]: (BREAKING CHANGE) Overwrite existing query params instead of appending.

• [put_path_params]: Preserve the path template when re-running the step.

• [redirect]: Strip userinfo from redirect locations and log a warning.

  Previously, redirecting to a URL with userinfo (e.g. http://user:pass@host)
  kept the userinfo in the request URL (without converting it to auth). It is
  now dropped so credentials supplied by the redirecting server aren't sent.

• [redirect]: Clear the request body, body options, and content headers when
  changing POST to GET after a 301, 302, or 303 response.

• [retry]: Use jitter by default.

• [retry]: Honor configured :retry_delay over Retry-After.

• (BREAKING CHANGE) Remove deprecated follow_redirects step.

• (BREAKING CHANGE) Remove deprecated output step.

• Require Elixir 1.15 or later.

sobelow/sobelow (sobelow)

v0.15.0

Compare Source

• Bug fixes
  • Config.Secrets no longer crashes the scan when a secret is written as
    anything other than a plain double-quoted string. Heredoc values and values
    containing escaped quotes previously raised a MatchError and aborted the
    entire run. These secrets are now reported, using the line of the enclosing
    config call.
  • A corrupt or unreadable version-check cache file no longer aborts the scan.
    Sobelow previously printed "This does not appear to be a Phoenix application"
    and exited 0 — a CI gate could pass having scanned nothing.
  • --strict now reports syntax errors instead of raising. It has been broken
    since Elixir 1.13 changed the error shape returned by
    Code.string_to_quoted/2. Errors are now reported as file:line:column:.
  • A template that cannot be parsed is now skipped (or reported under
    --strict) rather than aborting the scan with an EEx.SyntaxError. The
    error now names the offending template instead of nofile.
  • A malformed .sobelow-conf now produces an actionable message instead of a
    raw MatchError stacktrace. This mattered more since v0.14.1 began reading
    the file automatically.
  • An empty, whitespace-only, or comment-only .sobelow-conf is now read as
    no options rather than aborting the scan. Such a file parses to an empty
    block instead of a keyword list, so it originally crashed with a
    FunctionClauseError and then, once that was fixed, exited 1 with a
    configuration error. Since the file is read automatically, a stray
    touch .sobelow-conf or a truncated write was enough to break every scan
    in a project. Contents that cannot be interpreted are still an error.
  • --save-config now stores ignore_files relative to the project root.
    Absolute paths were previously baked into .sobelow-conf, breaking the
    committed file on every other machine and in CI.
  • Config.Secrets now reports the line of the secret itself when a config
    call spans multiple lines. The line search compared a tuple against an
    integer, so it never worked as intended.
  • An unwritable ~/.sobelow no longer fails a scan.
  • Fixed a string-interpolation typo that rendered dot-access variables as
    conn.${atom_to_string(field)}.
  • .sobelow-conf keys are now genuinely sorted alphabetically.
  • A .sobelow-conf can no longer stop Sobelow from scanning. --save-config
    wrote version into every file it generated, so
    mix sobelow --version --save-config produced a committed file that made
    every later run print the version and exit 0 — a CI gate reading that
    as a clean scan. version, details, all-details, save-config, and
    diff choose what Sobelow does rather than configure a scan, and are now
    accepted on the command line only. One in the file is ignored, with a
    warning when it would have changed anything. version is no longer
    written to the file in the first place.
  • # sobelow_skip comments are no longer thrown away over whitespace. The
    pattern demanded exactly one space after the # and exactly one before
    the list, so # sobelow_skip["XSS.Raw"], # sobelow_skip ["XSS.Raw"],
    and # sobelow_skip [ "XSS.Raw" ] were all ignored — silently, and
    indistinguishably from a skip that had simply not applied. Spacing around
    the marker, inside the list, and around commas is now irrelevant.
  • SQL.Query no longer reports a project's own query/1 as SQL injection.
    An unqualified query/query! call was matched regardless of what it
    referred to, so every call to a local function that happened to carry one
    of those very ordinary names produced a finding. The unqualified form is
    now only considered in a file that has import Ecto.Adapters.SQL or
    use Ecto.Repo — the two ways the bare name can actually reach Ecto.
    Qualified calls, such as Repo.query/1 and Ecto.Adapters.SQL.query/3,
    are unaffected.
  • Enhancements
    • Added --no-router, for scanning a project that has no Phoenix router.
      Sobelow warned that it could not find one and offered no way to silence it,
      which was noise for plain Elixir libraries. It is shorthand for
      --router :none, which can also be set in .sobelow-conf as
      router: :none. The router-dependent checks are skipped either way.
    • .sobelow-skips is now written in sorted order, so regenerating it after
      fixing or adding a finding produces a small diff instead of reshuffling the
      file. Entries sort by type, file, and line number — numerically, so line 10
      follows line 9 rather than line 1. The whole file is sorted, not just the
      newly added entries, so the ordering holds however many times it is
      regenerated. Comments and pre-v0.14 bare-fingerprint lines are preserved.
      Pass --legacy-skips for the previous append-only behaviour, which never
      rewrites lines it did not add.
    • # sobelow_skip comments now work on Phoenix router pipelines, not just
      functions. This makes Config.CSRF, Config.Headers, and Config.CSP
      suppressible per pipeline instead of only via --mark-skip-all, so an API
      pipeline that legitimately has no :protect_from_forgery can be annotated
      in place. Listing the parent Config module skips every Config check on
      that pipeline. As with function-level skips, this only takes effect under
      --skip.
    • A # sobelow_skip comment that cannot be read now warns on stderr, naming
      the file and line, instead of being dropped without a word. Single quotes
      and a list broken across several comment lines are still not accepted, but
      they now say so rather than leaving you to wonder why the finding came
      back.
    • --private now skips the version check entirely rather than still writing
      the cache file. It makes no network requests and touches no files outside
      the scanned project.
    • SOBELOW_HOME is now documented, and is treated as the directory holding
      the version-check cache.
    • Added usage-rules.md, following the usage_rules convention, so projects
      using AI coding assistants can pull Sobelow's guidance into their agent's
      context with mix usage_rules.sync. It is shipped in the Hex package.
    • Added AGENTS.md documenting the checker-module contract for contributors.
    • Added support for Elixir v1.20.x.
  • Testing
    • Added an end-to-end test harness (Sobelow.ScanCase) that runs full scans
      against fixture applications under test/fixtures/apps, plus regression
      coverage for every bug above. Line coverage went from 29% to 67%.
    • Added coverage for CLI option parsing, .sobelow-conf precedence, --exit
      and --threshold mapping, and the json/sarif/quiet/txt renderers.
    • Added end-to-end coverage for pipeline-level # sobelow_skip comments, and
      unit coverage for how skips associate with pipelines in the AST.
    • Sobelow.ScanCase.temp_fixture_file/3 now restores a committed fixture's
      original contents instead of deleting the file, so a test can vary a
      checked-in fixture without destroying it.
  • Misc
    • Replaced the deprecated :preferred_cli_env project key with def cli.
    • Bumped credo to ~> 1.7.19; 1.7.12 crashed on Elixir 1.20.
    • Removed a dead Elixir 1.5 version guard and fixed an always-true conditional
      in the SARIF renderer.

Upgrade notes

• Config.Secrets line numbers may change for config calls that span
  multiple lines, and for files where the same secret value appears more than
  once. Finding fingerprints include the line number, so any affected
  .sobelow-skips entries will stop matching and those findings will resurface.
  Re-run mix sobelow --mark-skip-all if you rely on a committed skip file.
• Secrets that previously crashed the scan are now reported. If a heredoc or
  escaped-quote secret exists in your config, you will see new findings where the
  scan previously failed outright.
• SOBELOW_HOME semantics changed from "path to the cache file" to "directory
  holding the cache file". The previous behaviour raised a MatchError for the
  natural usage, so this is unlikely to affect anyone.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[wttj-bot]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: mix.exs

Artifact update for req resolved to version 0.7.3, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 0.7.2
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/