Skip to content

Bump the production-dependencies group across 1 directory with 4 updates - #375

Merged
smn merged 1 commit into
developfrom
dependabot/hex/production-dependencies-b5fdb9b92c
Oct 28, 2026
Merged

Bump the production-dependencies group across 1 directory with 4 updates#375
smn merged 1 commit into
developfrom
dependabot/hex/production-dependencies-b5fdb9b92c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 4 updates in the / directory: credo, decimal, dialyxir and ex_doc.

Updates credo from 1.7.18 to 1.7.19

Release notes

Sourced from credo's releases.

v1.7.19

Check it out on Hex: https://hex.pm/packages/credo/1.7.19

  • Fix compatibility & compiler warnings with Elixir 1.20.0
Changelog

Sourced from credo's changelog.

1.7.19

  • Fix compatibility & compiler warnings with Elixir 1.20.0
Commits

Updates decimal from 2.3.0 to 2.4.1

Release notes

Sourced from decimal's releases.

v2.4.1

Bug fixes

  • Fix infinite loop in Decimal.to_integer/1 when the coefficient is zero and the exponent is negative (e.g. Decimal.new("0.0")). Such values now correctly convert to the integer 0.

v2.4.0

Security

  • Mitigate exponent amplification (CVE-2026-32686). Compact inputs such as 1e1000000 could force multi-second expansions during arithmetic, parsing, normalization, comparison, or formatting. Decimal.add/2 and Decimal.sub/2 now scale operands to precision + 2 digits with a sticky bit instead of materializing the full coefficient.

Enhancements

  • Add :max_digits and :max_exponent options to Decimal.parse/2 and Decimal.cast/2 to reject pathological inputs without expansion
  • Add :max_digits option to Decimal.to_string/3 to cap formatted output before materialization
  • Add :emax and :emin fields to Decimal.Context for IBM General Decimal Arithmetic-style overflow and underflow signaling
  • Optimize hot paths for large decimals: coef_length, normalize, to_integer, integer?, parsing, and large-coefficient string formatting
Changelog

Sourced from decimal's changelog.

v2.4.1 (2026-05-08)

Bug fixes

  • Fix infinite loop in Decimal.to_integer/1 when the coefficient is zero and the exponent is negative (e.g. Decimal.new("0.0")). Such values now correctly convert to the integer 0.

v2.4.0 (2026-05-07)

Security

  • Mitigate exponent amplification (CVE-2026-32686). Compact inputs such as 1e1000000 could force multi-second expansions during arithmetic, parsing, normalization, comparison, or formatting. Decimal.add/2 and Decimal.sub/2 now scale operands to precision + 2 digits with a sticky bit instead of materializing the full coefficient.

Enhancements

  • Add :max_digits and :max_exponent options to Decimal.parse/2 and Decimal.cast/2 to reject pathological inputs without expansion
  • Add :max_digits option to Decimal.to_string/3 to cap formatted output before materialization
  • Add :emax and :emin fields to Decimal.Context for IBM General Decimal Arithmetic-style overflow and underflow signaling
  • Optimize hot paths for large decimals: coef_length, normalize, to_integer, integer?, parsing, and large-coefficient string formatting
Commits

Updates dialyxir from 1.4.7 to 1.4.8

Release notes

Sourced from dialyxir's releases.

1.4.8

Added

  • Add support for the OTP 28 warnings :exact_compare, :opaque_compare, and :opaque_union.

Fixed

  • Handle line-and-column locations when matching line-specific warning ignores.

Changed

  • Update ExDoc to 0.40.3 to generate Markdown documentation and llms.txt.

Docs

  • Clarify the output and intended use of the ignore_file and ignore_file_strict formatters.
Changelog

Sourced from dialyxir's changelog.

Unreleased changes post [1.4.8]

[1.4.8] - 2026-09-05

Added

  • Add support for the OTP 28 warnings :exact_compare, :opaque_compare, and :opaque_union.

Fixed

  • Handle line-and-column locations when matching line-specific warning ignores.

Changed

  • Update ExDoc to 0.40.3 to generate Markdown documentation and llms.txt.

Docs

  • Clarify the output and intended use of the ignore_file and ignore_file_strict formatters.
Commits
  • 13bcb7d Release 1.4.8
  • 4a2b6d7 Merge pull request #584 from lud-wj/fix/ignoring-by-line
  • a2a4361 Merge branch 'master' into fix/ignoring-by-line
  • 31a4cd8 Merge pull request #601 from BobbieBarker/docs/exdoc-0.40
  • 6ba7b38 Update ExDoc to 0.40.3
  • 3553678 Add OTP 28 warning support: exact_compare, opaque_compare, opaque_union (#591)
  • 19dd690 Merge pull request #597 from dl-alexandre/codex/clarify-ignore-file-format
  • f12db01 clarify ignore file formatter docs
  • cdcea96 fix: Fixed dialyzer ignore by line for warnings with line/col
  • 9fbbaf5 update changelog
  • See full diff in compare view

Updates ex_doc from 0.40.1 to 0.40.4

Changelog

Sourced from ex_doc's changelog.

v0.40.4 (2026-09-03)

  • Enhancements

    • Add :api_reference_noindex option to keep search engines from indexing api-reference.html
    • Generate reproducible HTML and EPUB output
    • Link HexDocs packages through their per-package subdomains

  • Bug fixes

    • Preserve in-page anchors during Swup navigation and fully reload navigation between ExDoc builds
    • Format Elixir specs consistently regardless of their source line numbers
    • Autolink the Erlang/OTP 29 built-in record/0 type
    • Fix focus outline positioning for top-content heading action icons

v0.40.3 (2026-05-21)

  • Enhancements
    • Add autolinking for Erlang/OTP 29 native records

v0.40.2 (2026-05-08)

  • Bug fixes
    • Add rel="nofollow" to external links in HTML output
    • Use blockquote in llms.txt description
    • Void elements in epub, such wbr, must be terminated by the matching end-tag
    • Fix content container scrolling in older versions of Safari
    • Skip HTML comments when computing synopsis
    • Fix markdown backend code fence language and opaque type display
    • Fix false positive warning when linking to asset files
    • Prevent #search selector from impacting user content
    • Raise on extras that conflict with reserved filenames
    • Fix styling of admonition blocks
Commits
  • 80270f3 Release v0.40.4
  • 934cf54 Reference to missing section (#2264)
  • b5679af Add license information for remixicon font (#2263)
  • 850f709 Bump brace-expansion from 1.1.12 to 1.1.18 in /assets (#2261)
  • 873e03e Bump postcss from 8.5.15 to 8.5.26 in /assets (#2259)
  • 27660d3 Bump js-yaml from 4.2.0 to 4.3.1 in /assets (#2260)
  • ffec214 Bump postcss from 8.5.6 to 8.5.15 in /assets (#2241)
  • 23cbd23 epub: Honor SOURCE_DATE_EPOCH for dcterms:modified and dc:identifier (#2256)
  • a37128a Use a fixed makeup group_prefix for reproducible HTML output (#2255)
  • 01f4763 Update earmark_parser dependency version -> 1.4.46 (#2254)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the production-dependencies group across 1 directory with 4 updates
2e0df1a 
Bumps the production-dependencies group with 4 updates in the / directory: [credo](https://github.com/rrrene/credo), [decimal](https://github.com/ericmj/decimal), [dialyxir](https://github.com/jeremyjh/dialyxir) and [ex_doc](https://github.com/elixir-lang/ex_doc).


Updates `credo` from 1.7.18 to 1.7.19
- [Release notes](https://github.com/rrrene/credo/releases)
- [Changelog](https://github.com/rrrene/credo/blob/master/CHANGELOG.md)
- [Commits](rrrene/credo@v1.7.18...v1.7.19)

Updates `decimal` from 2.3.0 to 2.4.1
- [Release notes](https://github.com/ericmj/decimal/releases)
- [Changelog](https://github.com/ericmj/decimal/blob/v2.4.1/CHANGELOG.md)
- [Commits](ericmj/decimal@v2.3.0...v2.4.1)

Updates `dialyxir` from 1.4.7 to 1.4.8
- [Release notes](https://github.com/jeremyjh/dialyxir/releases)
- [Changelog](https://github.com/jeremyjh/dialyxir/blob/master/CHANGELOG.md)
- [Commits](jeremyjh/dialyxir@1.4.7...1.4.8)

Updates `ex_doc` from 0.40.1 to 0.40.4
- [Release notes](https://github.com/elixir-lang/ex_doc/releases)
- [Changelog](https://github.com/elixir-lang/ex_doc/blob/main/CHANGELOG.md)
- [Commits](elixir-lang/ex_doc@v0.40.1...v0.40.4)

---
updated-dependencies:
- dependency-name: credo
  dependency-version: 1.7.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: decimal
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: dialyxir
  dependency-version: 1.4.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: ex_doc
  dependency-version: 0.40.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code labels Oct 28, 2026
@smn
smn merged commit 0de7fa3 into develop Oct 28, 2026
2 checks passed
@dependabot
dependabot Bot deleted the dependabot/hex/production-dependencies-b5fdb9b92c branch October 28, 2026 14:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@smn smn smn approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file elixir Pull requests that update elixir code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@smn