[dependabot]

Bumps the production-dependencies group with 2 updates in the / directory: credo and ex_doc.

Updates credo from 1.7.18 to 1.7.19

Release notes

Sourced from credo's releases.

v1.17.19

Check it out on Hex: https://hex.pm/packages/credo/1.7.19

• Fix compatibility & compiler warnings with Elixir 1.20.0

Changelog

Sourced from credo's changelog.

1.7.19

• Fix compatibility & compiler warnings with Elixir 1.20.0

Commits

• d4a88d4 Bump version to 1.7.19
• b87f0b6 Update CHANGELOG
• c4ed6df Use mix format
• 9172f39 Fix token error
• a6de9b5 Add reproducing test for #1275
• b726ad4 Run mix format
• ccd27fb Add test for sigil_p position
• 8a03b78 Clean stale deps
• a902c97 Set "old credo" to 1.7.18
• cc2ce91 Update GitHub actions
• Additional commits viewable in compare view

Updates decimal from 2.3.0 to 2.4.1

Release notes

Sourced from decimal's releases.

v2.4.1

Bug fixes

• Fix infinite loop in Decimal.to_integer/1 when the coefficient is zero and the exponent is negative (e.g. Decimal.new("0.0")). Such values now correctly convert to the integer 0.

v2.4.0

Security

• Mitigate exponent amplification (CVE-2026-32686). Compact inputs such as 1e1000000 could force multi-second expansions during arithmetic, parsing, normalization, comparison, or formatting. Decimal.add/2 and Decimal.sub/2 now scale operands to precision + 2 digits with a sticky bit instead of materializing the full coefficient.

Enhancements

• Add :max_digits and :max_exponent options to Decimal.parse/2 and Decimal.cast/2 to reject pathological inputs without expansion
• Add :max_digits option to Decimal.to_string/3 to cap formatted output before materialization
• Add :emax and :emin fields to Decimal.Context for IBM General Decimal Arithmetic-style overflow and underflow signaling
• Optimize hot paths for large decimals: coef_length, normalize, to_integer, integer?, parsing, and large-coefficient string formatting

Changelog

Sourced from decimal's changelog.

v2.4.1 (2026-05-08)

Bug fixes

• Fix infinite loop in Decimal.to_integer/1 when the coefficient is zero and the exponent is negative (e.g. Decimal.new("0.0")). Such values now correctly convert to the integer 0.

v2.4.0 (2026-05-07)

Security

• Mitigate exponent amplification (CVE-2026-32686). Compact inputs such as 1e1000000 could force multi-second expansions during arithmetic, parsing, normalization, comparison, or formatting. Decimal.add/2 and Decimal.sub/2 now scale operands to precision + 2 digits with a sticky bit instead of materializing the full coefficient.

Enhancements

• Add :max_digits and :max_exponent options to Decimal.parse/2 and Decimal.cast/2 to reject pathological inputs without expansion
• Add :max_digits option to Decimal.to_string/3 to cap formatted output before materialization
• Add :emax and :emin fields to Decimal.Context for IBM General Decimal Arithmetic-style overflow and underflow signaling
• Optimize hot paths for large decimals: coef_length, normalize, to_integer, integer?, parsing, and large-coefficient string formatting

Commits

• d071621 Release v2.4.1
• 9c361f8 Release v2.4.0
• 97a23e6 Mitigate decimal exponent amplification (CVE-2026-32686)
• 06bc35d Add support for Elixir 1.19, bump CI actions and runner (#225)
• 1414ccc Add support for OTP 28 and Elixir 1.18 (#224)
• cd6aa59 Update custom JSON encoder example
• c9347ed Document protocol implementations (#220)
• 8843f5b Check DBL_MIN/DBL_MAX on Decimal.from_float (#207)
• d53c625 Fix parsing of 1e-d (#218)
• c631296 Fix typo in typespec (#217)
• See full diff in compare view

Updates ex_doc from 0.40.1 to 0.40.3

Changelog

Sourced from ex_doc's changelog.

v0.40.3 (2026-05-21)

• Enhancements
  • Add autolinking for Erlang/OTP 29 native records

v0.40.2 (2026-05-08)

• Bug fixes
  • Add rel="nofollow" to external links in HTML output
  • Use blockquote in llms.txt description
  • Void elements in epub, such wbr, must be terminated by the matching end-tag
  • Fix content container scrolling in older versions of Safari
  • Skip HTML comments when computing synopsis
  • Fix markdown backend code fence language and opaque type display
  • Fix false positive warning when linking to asset files
  • Prevent #search selector from impacting user content
  • Raise on extras that conflict with reserved filenames
  • Fix styling of admonition blocks

Commits

• 07a6abc Release v0.40.3
• 02904bb Fix record autolink - and bump CI (#2240)
• c868c6a Release v0.40.2
• b9cc372 Update makeup_erlang version (#2236)
• b389d17 Fix dead code and overriden clauses found by the type system
• 25523c9 Update assets
• dbed340 Raise on extras that conflict with reserved filenames
• 2808e45 Prevent #search selector from impacting user content
• bc90968 Update assets
• 9333979 Fix inline code font size in headings (#2220)
• Additional commits viewable in compare view

[smn]

@dependabot rebase

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.