deps: exconstructor dependency update 2026-09-02

[humberaquino]

Scope: routine. Updated 2 dependencies, deferred 5, excluded 0 major-magnitude dependencies as out of this PR's scope (see "Majors excluded by scope" below), closed 0 of 1 open CVEs. Bumped exconstructor 1.3.3 → 1.3.4. The one open advisory (earmark) has no fixed release: every published version of earmark is affected and the package is retired upstream, so it stays open — see CVEs.

This repo has no dependencies label, so the PR is unlabeled.

Updated

dep	from → to	tier
ex_doc	0.40.1 → 0.40.3	patch
earmark	1.4.48 → 1.4.49	cve

earmark moved to its latest published release. That release changes only the README (adds a "do not use on untrusted input" disclaimer) and does not address the advisory listed under CVEs — no published version does. No mix.exs constraint changes were needed.

Version bump

exconstructor 1.3.3 → 1.3.4 (patch bump). CHANGELOG.md updated.

Deferred

dep	available	reason	detail
earmark_parser	1.4.46 (from 1.4.44)	transitive-only	pulled in by ex_doc (~> 1.4.44); not declared in mix.exs
erlex	0.2.9 (from 0.2.8)	transitive-only	pulled in by dialyxir; not declared in mix.exs
jason	1.4.5 (from 1.4.4)	transitive-only	pulled in by excoveralls; not declared in mix.exs
makeup	1.2.2 (from 1.2.1)	transitive-only	pulled in by makeup_elixir / makeup_erlang; not declared in mix.exs
makeup_erlang	1.1.0 (from 1.0.3)	transitive-only	pulled in by ex_doc; not declared in mix.exs

Already up to date (4 of 11): dialyxir 1.4.7, excoveralls 0.18.5, makeup_elixir 1.0.1, nimble_parsec 1.4.2.

Majors excluded by scope

None; every major-magnitude dependency was either up to date or in scope.

CVEs

id	aliases	dep	severity	cvss	resolved_by
GHSA-52mm-h59v-f3c7	CVE-2026-48591, EEF-CVE-2026-48591	earmark	moderate	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N	null

Still open after this PR — no fix exists. OSV records every published earmark release (1.4.1 through 1.5.0-pre1, the newest) as affected and names no fixed version; querying OSV for 1.4.49 specifically still returns this advisory. earmark is retired on hex.pm ("no longer maintained; migrate to a replacement, for example MDEx"). The only way to clear it is to remove or replace the earmark dependency, which is a change to the dependency set rather than a version bump and is out of this PR's scope. For context: earmark is a :dev-only dependency here and is not shipped with the library; nothing in lib/, config/, or mix.exs references it directly, and current ex_doc uses earmark_parser rather than earmark, so it may simply be removable. Severity label is OSV's own; hex's mix deps.get advisory output did not include this package.

Breaking changes adopted

None this PR.

Code changes

No code changes required. Only mix.lock, and mix.exs + CHANGELOG.md for the version bump, changed.

Migrations added

None this PR.

Config changes

None. Neither ex_doc nor earmark is referenced in config/config.exs or lib/; the ex_doc 0.40.2/0.40.3 release notes list no renamed, removed, or newly required options, and earmark 1.4.49 changes only its README. This repo has no config/runtime.exs, so no runtime-sourced config is involved.

Gate results

Gates are the commands .circleci/config.yml's build job runs (MIX_ENV=test): mix do deps.get, compile, mix format --check-formatted, mix dialyzer, mix coveralls.circle. Locally they ran on the .tool-versions toolchain (Elixir 1.19.4-otp-28 / Erlang 28.2); CI's image is cimg/elixir:1.18.2-erlang-26.2.1, so CI is the evidence for that older toolchain. Each local gate was run once at the base commit (baseline, all green) and again after every commit on this branch.

gate	venue	result	detail
mix do deps.get, compile	local	pass	baseline and after each commit
mix format --check-formatted	local	pass	baseline and after each commit
mix dialyzer	local	pass	0 errors; baseline and after each commit
mix coveralls.circle	local	pass	run as mix coveralls (same test run; coverage printed locally instead of posted to coveralls.io): 20 tests, 0 failures, 97.8% coverage; baseline and after each commit
ci/circleci: build	ci	pass	https://circleci.com/gh/appcues/exconstructor/101 (image cimg/elixir:1.18.2-erlang-26.2.1)
CodeRabbit	ci	pass
WhiteSource Security Check	ci	skipped	reported NEUTRAL

Verification

Before being marked ready, this PR was independently re-checked against its own claims: 7/7 checks pass. Checked: repo kind (library — package block present) and a patch-only version bump with a CHANGELOG entry; CVE claims re-derived by scanning both the base and head mix.lock against OSV (the earmark advisory is present in both, so it is correctly reported as still open, and no new advisory was introduced); major-boundary authorization (both moves are patch-level, nothing crosses); forbidden files untouched (no CI config, test, credo, or dialyzer-ignore file changed); every required body section present; content is about this repo and its dependencies only; and CI state (ci/circleci: build pass, CodeRabbit pass, WhiteSource Security Check neutral/skipped). No check on this PR waits on a manual approval.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: ef0e2fcb-a8a7-403d-8ed9-161810d71570

📥 Commits

Reviewing files that changed from the base of the PR and between d112253 and c9fe500.

⛔ Files ignored due to path filters (1)

• mix.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• CHANGELOG.md
• mix.exs

Included review availability: 8 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour.

---

📝 Walkthrough

Walkthrough

The project version was updated from 1.3.3 to 1.3.4. The changelog now includes a 1.3.4 entry that records updates to ex_doc 0.40.3 and earmark 1.4.49.

Merge Risk: ⚪ Minimal · up to c9fe5

This PR makes a localized dependency and version-metadata update with no identified correctness, security, or runtime issue; no actionable merge-blocking risk remains beyond completing the pending CI check.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the dependency update for exconstructor, which is the main change in the pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch deps/2026-09-02

---

_{Comment @coderabbitai help to get the list of available commands.}