chore(deps): Bump the mix-minor-and-patch group across 1 directory with 3 updates

[dependabot]

Bumps the mix-minor-and-patch group with 3 updates in the /server directory: bandit, req and sbom.

Updates bandit from 1.12.5 to 1.13.1

Changelog

Sourced from bandit's changelog.

1.13.1 (15 Oct 2026)

Reverts

• Revert the stale conn check added in 1.13.0 (#668), since a number of valid code paths in Phoenix depend on stale conns (notably, Plug.Parsers errors rendered by Phoenix.Endpoint.RenderErrors). See elixir-plug/plug#1331

1.13.0 (15 Oct 2026)

Enhancements

• Add a compress_chunked option to compress chunked responses with gzip and zstd (#707, thanks @​iStefo!)
• Clarify inet6 option behaviour on dual-stack platforms (#709, #700, thanks @​adelton!)
• Unroll WebSocket masking over 32-byte blocks (#674, thanks @​mpettibone!)
• Drain HTTP/2 pending sends without repeated List.delete/2 (#673, thanks @​mpettibone!)
• Short-circuit header token lookup on the first match (#699, thanks @​claytongentry!)
• Scope the workflow tokens to what each job actually uses (#702, thanks @​Totara-thib!)
• Add a Plumber check and score badge (#712, thanks @​Totara-thib!)
• Fix recent releases changelog headings in docs (#672, thanks @​dinokovac-river!)

Changes

• Require Thousand Island 1.6, and use the peername it now captures when it accepts a connection (#718)
• Require hpax 1.1 and drop the nil field value workaround (#706, thanks @​acrogenesis!)
• Report conn.port as an integer for CONNECT requests, as Plug.Conn requires
• Close idle connections which send no bytes silently instead of answering 408 (#689, thanks @​tomciopp!)
• RFC Conformance: Enforce Host requirements for HTTP/1.1 targets (#679, thanks @​mpettibone!)
• RFC Conformance: Complete HTTP/2 field validation (#680, thanks @​mpettibone!)
• RFC Conformance: Validate HTTP/2 content length on initial END_STREAM (#681, thanks @​mpettibone!)
• RFC Conformance: Enforce HTTP/2 trailer field section requirements (#682, thanks @​mpettibone!)
• RFC Conformance: Validate request transfer coding before Plug dispatch (#683, thanks @​mpettibone!)
• RFC Conformance: Fix HTTP/1.0 streaming response framing (#684, thanks @​mpettibone!)
• RFC Conformance: Accept empty non-final WebSocket continuation frames (#685, thanks @​mpettibone!)
• RFC Conformance: Validate WebSocket client keys (#686, thanks @​mpettibone!)

Fixes

• Validate the authority of HTTP/1 absolute-form and authority-form request targets against the same grammar as the Host header (GHSA-v53v-9hvg-37jf, thanks @​euriconicacio!)
• Bound HTTP/2 sends blocked on a send window by progress, so that a trickle of window updates can no longer keep a stream pinned indefinitely (GHSA-69m6-wcv4-rwcf, thanks @​tomciopp!)
• Reject control bytes in HTTP/1 request targets (#713, #711, thanks @​PJUllrich!)
• Fix crash when a client resets an HTTP/1 connection before Bandit reads its peer address (#718, #717, thanks @​mhsdef!)
• Drain all queued HTTP/2 DATA frames of an unread body once a response has been sent (#710, #697, thanks @​jamilbk!)
• Preserve independent error responses on HTTP/1 keep-alive and pipelined requests, and frame empty 4xx/5xx error responses with Content-Length: 0 (#705, thanks @​jeregrine!)
• Close instead of draining when a plug never honors Expect: 100-continue (#695, thanks @​tomciopp!)
• Fix chunked read_body(length: 0) falsely completing the body (#691, thanks @​tomciopp!)
• Observe RST_STREAM while blocked on the stream send window (#688, thanks @​tomciopp!)

... (truncated)

Commits

• ee75d31 Version bump to 1.13.1
• 84e9d1d Revert "Guard against stale conn reuse in Bandit.Adapter (#668)" (#719)
• d6daa4a Version bump to 1.13.0
• 02a3853 Add a Plumber check and score badge (#712)
• 0c53a6e Require Thousand Island 1.6 and use its cached peername (#718)
• 8993dae Bump finch from 0.21.0 to 0.24.0 (#716)
• 6ea8021 Merge commit from fork
• 2758910 Bump req from 0.7.4 to 0.7.5 (#715)
• 70014a0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#714)
• c95938d Reject control bytes in HTTP/1 request targets (#713)
• Additional commits viewable in compare view

Updates req from 0.7.4 to 0.7.5

Release notes

Sourced from req's releases.

v0.7.5

• put_aws_sigv4: Fix SigV4 signing on retries.
• redirect: Change method to GET (except HEAD) on HTTP 303. Thanks to @​euriconicacio for reporting this.

Changelog

Sourced from req's changelog.

v0.7.5 (2026-10-06)

• [put_aws_sigv4]: Fix SigV4 signing on retries.
• [redirect]: Change method to GET (except HEAD) on HTTP 303.

Commits

• 2ce74f1 Release v0.7.5
• 10c7414 Fix connect timeout test
• 331c5d9 Fix SigV4 signing on retries
• bd18cb2 redirect: Change method to GET (except HEAD) on HTTP 303
• See full diff in compare view

Updates sbom from 0.11.0 to 0.12.0

Release notes

Sourced from sbom's releases.

v0.12.0

What's Changed

• Build burrito targets in parallel via matrix by @​maennchen in erlef/mix_sbom#156
• Keep the application version in the purl for Erlang apps by @​Hermanverschooten in erlef/mix_sbom#158
• Add vulnerabilities from OSV.dev by @​igorgbr in erlef/mix_sbom#160
• Accept optional applications in application/0 by @​maennchen in erlef/mix_sbom#169

Dependency Updates

• Update ghcr.io/oss-review-toolkit/ort Docker tag to v94.2.0 by @​renovate[bot] in erlef/mix_sbom#159
• Bump the github-actions group with 2 updates by @​dependabot[bot] in erlef/mix_sbom#161
• Update ghcr.io/oss-review-toolkit/ort Docker tag to v95 by @​renovate[bot] in erlef/mix_sbom#162
• Update ghcr.io/oss-review-toolkit/ort Docker tag to v96 by @​renovate[bot] in erlef/mix_sbom#163
• Bump the github-actions group with 4 updates by @​dependabot[bot] in erlef/mix_sbom#165
• Bump protobuf from 0.17.0 to 0.17.1 in the mix-dependencies group by @​dependabot[bot] in erlef/mix_sbom#164
• Allow hex_core 0.20 by @​maennchen in erlef/mix_sbom#168
• Update ghcr.io/oss-review-toolkit/ort Docker tag to v97 by @​renovate[bot] in erlef/mix_sbom#167

New Contributors

• @​igorgbr made their first contribution in erlef/mix_sbom#160

Full Changelog: erlef/mix_sbom@v0.11.0...v0.12.0

Commits

• 96bb84f Release v0.12.0
• a821425 Accept optional applications in application/0 (#169)
• 4639073 Allow hex_core 0.20 (#168)
• bbc248f Update ghcr.io/oss-review-toolkit/ort Docker tag to v97 (#167)
• ebbbefb Bump protobuf from 0.17.0 to 0.17.1 in the mix-dependencies group (#164)
• 22d0b50 Bump the github-actions group with 4 updates (#165)
• 92ad599 Add vulnerabilities from OSV.dev (#160)
• 06ac313 Update ghcr.io/oss-review-toolkit/ort Docker tag to v96 (#163)
• 38b9a28 Update ghcr.io/oss-review-toolkit/ort Docker tag to v95 (#162)
• 9904379 Bump the github-actions group with 2 updates (#161)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions