build(deps): bump the production-dependencies group with 4 updates

[dependabot]

Bumps the production-dependencies group with 4 updates: ex_ast, glob_ex, phx_new and req.

Updates ex_ast from 0.12.5 to 0.13.1

Release notes

Sourced from ex_ast's releases.

v0.13.1

Compatibility

• Restored support for Elixir 1.18, which was unintentionally excluded by the 0.13.0 package requirement.

v0.13.0

Added

• Extended ellipsis patterns to lists and tuples, including leading, trailing, and middle captures, and added explicit %{...} / %Struct{...} rest patterns for maps and structs.
• Added wildcard callee patterns: _(...) for any local call, _._(...) for any remote call, and module- or function-specific forms such as Repo._(...) and _.section(...).
• Added name/arity definition patterns such as def name/2 do ... end and defp _/_ do ... end.
• Added repeatable -e / --pattern options to mix ex_ast.search for running multiple tagged patterns in one file traversal, with per-pattern selector filters, counts, and JSON output.
• Added --count-by-file to mix ex_ast.search.

Changed

• Map patterns now use subset matching consistently in top-level and nested searches.

Fixed

• Piped calls no longer also match the lower arity of their unnormalized right-hand side.
• Literal lists, tuples, atoms, strings, and numbers wrapped by Sourceror are no longer reported twice during searches.
• Two-element tuple patterns now match consistently in call arguments, list elements, match and with clauses, and ordinary quoted AST sources.

v0.12.10

Added

• Added opt-in expand_imports: true matching for bare and except: imports, with module-scoped imports, local-definition shadowing, and preserved function/macro import semantics.
• Added --expand-imports to mix ex_ast.search.

v0.12.9

Fixed

• Source term extraction now also indexes the pipe operator itself for piped source calls, preserving exact candidate retrieval for pipe-pattern queries.

... (truncated)

Changelog

Sourced from ex_ast's changelog.

0.13.1 - 2026-07-23

Compatibility

• Restored support for Elixir 1.18, which was unintentionally excluded by the 0.13.0 package requirement.

0.13.0 - 2026-07-22

Added

• Extended ellipsis patterns to lists and tuples, including leading, trailing, and middle captures, and added explicit %{...} / %Struct{...} rest patterns for maps and structs.
• Added wildcard callee patterns: _(...) for any local call, _._(...) for any remote call, and module- or function-specific forms such as Repo._(...) and _.section(...).
• Added name/arity definition patterns such as def name/2 do ... end and defp _/_ do ... end.
• Added repeatable -e / --pattern options to mix ex_ast.search for running multiple tagged patterns in one file traversal, with per-pattern selector filters, counts, and JSON output.
• Added --count-by-file to mix ex_ast.search.

Changed

• Map patterns now use subset matching consistently in top-level and nested searches.

Fixed

• Piped calls no longer also match the lower arity of their unnormalized right-hand side.
• Literal lists, tuples, atoms, strings, and numbers wrapped by Sourceror are no longer reported twice during searches.
• Two-element tuple patterns now match consistently in call arguments, list elements, match and with clauses, and ordinary quoted AST sources.

0.12.10

Added

• Added opt-in expand_imports: true matching for bare and except: imports, with module-scoped imports, local-definition shadowing, and preserved function/macro import semantics.
• Added --expand-imports to mix ex_ast.search.

0.12.9

Fixed

... (truncated)

Commits

• 60660a2 Prepare 0.13.1 release
• 0e0d92f Merge pull request #14 from mikehostetler/agent/restore-elixir-1-18-support
• af2aeba fix: restore Elixir 1.18 support
• cc0ae0a Prepare 0.13.0 release
• 95c0042 Merge pull request #7 from rodrigues/vr/fix_map
• 2693868 Fix map subset examples in README
• 0229056 Merge remote-tracking branch 'origin/master' into fix-and-update-pr7
• a677c20 Merge pull request #10 from rodrigues/vr/arity_syntax
• b0d0b58 Merge remote-tracking branch 'origin/master' into update-pr10-for-merge
• 6c92e74 Merge pull request #12 from rodrigues/vr/search_many
• Additional commits viewable in compare view

Updates glob_ex from 0.1.11 to 0.1.12

Changelog

Sourced from glob_ex's changelog.

Changelog

Commits

• 1999fd6 Support windows root
• c7f19d1 Merge pull request #14 from hrzndhrn/elixir-1-19
• 275155d Update macos run
• 122b3cf Set runs-on: windos-2022
• fd8389a Fix win run
• 28cce31 Fix win run
• 228ac0f Upudate for Elixir 1.19
• 01360a0 Update ci.yml
• d878e0a Update ci.yml
• 1c801b5 Update ci.yml
• Additional commits viewable in compare view

Updates phx_new from 1.8.8 to 1.8.9

Changelog

Sourced from phx_new's changelog.

1.8.9 (2026-07-07)

Security fixes

• CVE-2026-56811: Add a max_channels_per_transport option (defaulting to 100) to prevent a single client from spawning an unbounded number of channels (processes), eventually exhausting the server's memory or process limit.
• CVE-2026-56812: Prevent presence keys from colliding with Object.prototype properties members, crashing the JS Presence client
• Enforce longpoll batch size introduced in 1.8.6. This is additional hardening against CVE-2026-32689. If your application sends events with a very high frequency and uses long polling, such that a single longpoll request would exceed 100 events, you should update to 1.8.7 first.

Commits

• 734c8d1 Release v1.8.9
• beffc4d fix presence keys colliding with object prototype chain
• 16e295d Limit the number of channels a single transport process can join
• 211ff62 Allow authToken to be a function (#6751)
• 6cb2a83 Enforce longpoll batch size
• 5bf1ce6 Add missing test file
• 046accc Normalize route verb while grouping
• 21d1462 Group routes by verb during compilation (#6739)
• 9d3f1f6 phx.gen.release: Document new Bob Web UI (#6721)
• afcac09 Bump undici from 7.25.0 to 7.28.0 (#6736)
• Additional commits viewable in compare view

Updates req from 0.6.2 to 0.7.1

Changelog

Sourced from req's changelog.

v0.7.1 (2026-07-28)

• Deprecate cache: true/[cache] step. It will be removed in Req v0.8. I plan a comprehensive cache solution for Req v1.0+.

v0.7.0 (2026-07-28)

• [Req]: Add Req.new(req, options).

• [Req]: Treat URL userinfo as Basic Authentication.

• [Req], [Req.Request]: Deprecate adapter: fun in favour of adapter: mod.

• [Req.Request]: (BREAKING CHANGE) Remove current_request_steps field.

• [Req.Request]: Fix redacting remaining auth values.

• (BREAKING CHANGE) Replace run_finch step with [Req.Finch] adapter module.

• (BREAKING CHANGE) Replace put_plug and run_plug steps with [Req.Plug] adapter module.

• [Req.Finch]: Support finch: options.

• [Req.Finch]: Support :request_timeout.

• [Req.Finch]: Fix handling duplicate response headers.

• [Req.Finch]: Deprecate finch: name in favour of finch: [name: name].

• [Req.Finch]: Deprecate pool_timeout: value in favour of finch: [pool_timeout: value].

• [Req.Finch]: Deprecate pool_max_idle_time: value in favour of finch: [pool_max_idle_time: value].

• [Req.Finch]: Deprecate :finch_request.

• [Req.Plug]: Handle individual response body chunks.

• [Req.Plug]: Support non-UTF8 request params.

• [Req.Plug]: Put original request private data in conn.private.

• [Req.Test]: Allow descendant processes.

• [Req.Test]: Fix concurrent plug fetches immediately after switching to shared mode.

• [compress_body]: Do nothing when request content-encoding is already set.

• [compress_body]: Update multipart boundary when re-running the step.

• [compressed], [decode_body]: Replace optional ezstd dependency with Erlang/OTP 28+ built-in :zstd.

... (truncated)

Commits

• 168a11e Release v0.7.1
• a9c24a1 Deprecate cache: true/cache step
• 6a4f305 Release v0.7.0
• d770830 Hide body: fun for now
• e450b25 Update CI
• 8123419 Fix flaky httpc into: fun test
• fb7bb10 Revert "New step: expect (#493)"
• ed894af Revert "Add assigns (#492)"
• c47a208 Update docs
• be40081 Req.Finch: Deprecate :finch_request
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions