[dependabot]

Bumps the hex group with 6 updates in the / directory:

Package	From	To
bandit	1.12.5	1.13.1
daisyui	v5.7.47	v5.7.50
dns_cluster	0.3.0	0.3.1
esbuild	0.10.0	0.10.1
phoenix	1.8.15	1.8.16
phoenix_live_view	1.2.12	1.2.13

Updates bandit from 1.12.5 to 1.13.1

Changelog

Sourced from bandit's changelog.

1.13.1 (15 Oct 2026)

Reverts

• Revert the stale conn check added in 1.13.0 (#668), since a number of valid code paths in Phoenix depend on stale conns (notably, Plug.Parsers errors rendered by Phoenix.Endpoint.RenderErrors). See elixir-plug/plug#1331

1.13.0 (15 Oct 2026)

Enhancements

• Add a compress_chunked option to compress chunked responses with gzip and zstd (#707, thanks @​iStefo!)
• Clarify inet6 option behaviour on dual-stack platforms (#709, #700, thanks @​adelton!)
• Unroll WebSocket masking over 32-byte blocks (#674, thanks @​mpettibone!)
• Drain HTTP/2 pending sends without repeated List.delete/2 (#673, thanks @​mpettibone!)
• Short-circuit header token lookup on the first match (#699, thanks @​claytongentry!)
• Scope the workflow tokens to what each job actually uses (#702, thanks @​Totara-thib!)
• Add a Plumber check and score badge (#712, thanks @​Totara-thib!)
• Fix recent releases changelog headings in docs (#672, thanks @​dinokovac-river!)

Changes

• Require Thousand Island 1.6, and use the peername it now captures when it accepts a connection (#718)
• Require hpax 1.1 and drop the nil field value workaround (#706, thanks @​acrogenesis!)
• Report conn.port as an integer for CONNECT requests, as Plug.Conn requires
• Close idle connections which send no bytes silently instead of answering 408 (#689, thanks @​tomciopp!)
• RFC Conformance: Enforce Host requirements for HTTP/1.1 targets (#679, thanks @​mpettibone!)
• RFC Conformance: Complete HTTP/2 field validation (#680, thanks @​mpettibone!)
• RFC Conformance: Validate HTTP/2 content length on initial END_STREAM (#681, thanks @​mpettibone!)
• RFC Conformance: Enforce HTTP/2 trailer field section requirements (#682, thanks @​mpettibone!)
• RFC Conformance: Validate request transfer coding before Plug dispatch (#683, thanks @​mpettibone!)
• RFC Conformance: Fix HTTP/1.0 streaming response framing (#684, thanks @​mpettibone!)
• RFC Conformance: Accept empty non-final WebSocket continuation frames (#685, thanks @​mpettibone!)
• RFC Conformance: Validate WebSocket client keys (#686, thanks @​mpettibone!)

Fixes

• Validate the authority of HTTP/1 absolute-form and authority-form request targets against the same grammar as the Host header (GHSA-v53v-9hvg-37jf, thanks @​euriconicacio!)
• Bound HTTP/2 sends blocked on a send window by progress, so that a trickle of window updates can no longer keep a stream pinned indefinitely (GHSA-69m6-wcv4-rwcf, thanks @​tomciopp!)
• Reject control bytes in HTTP/1 request targets (#713, #711, thanks @​PJUllrich!)
• Fix crash when a client resets an HTTP/1 connection before Bandit reads its peer address (#718, #717, thanks @​mhsdef!)
• Drain all queued HTTP/2 DATA frames of an unread body once a response has been sent (#710, #697, thanks @​jamilbk!)
• Preserve independent error responses on HTTP/1 keep-alive and pipelined requests, and frame empty 4xx/5xx error responses with Content-Length: 0 (#705, thanks @​jeregrine!)
• Close instead of draining when a plug never honors Expect: 100-continue (#695, thanks @​tomciopp!)
• Fix chunked read_body(length: 0) falsely completing the body (#691, thanks @​tomciopp!)
• Observe RST_STREAM while blocked on the stream send window (#688, thanks @​tomciopp!)

... (truncated)

Commits

• ee75d31 Version bump to 1.13.1
• 84e9d1d Revert "Guard against stale conn reuse in Bandit.Adapter (#668)" (#719)
• d6daa4a Version bump to 1.13.0
• 02a3853 Add a Plumber check and score badge (#712)
• 0c53a6e Require Thousand Island 1.6 and use its cached peername (#718)
• 8993dae Bump finch from 0.21.0 to 0.24.0 (#716)
• 6ea8021 Merge commit from fork
• 2758910 Bump req from 0.7.4 to 0.7.5 (#715)
• 70014a0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#714)
• c95938d Reject control bytes in HTTP/1 request targets (#713)
• Additional commits viewable in compare view

Updates daisyui from v5.7.47 to v5.7.50

Release notes

Sourced from daisyui's releases.

v5.7.50

🌼 Read changelog: https://daisyui.com/docs/changelog/

📦 Install this update:

npm i -D daisyui@5.7.50

💚 Thank you for using daisyUI!

v5.7.48

🌼 Read changelog: https://daisyui.com/docs/changelog/

📦 Install this update:

npm i -D daisyui@5.7.48

💚 Thank you for using daisyUI!

Changelog

Sourced from daisyui's changelog.

5.7.50 (2026-10-13)

5.7.49 (2026-10-13)

Bug Fixes

• divider: keep the divider line visible in forced colors mode (#4798) (23b1176)
• loading: keep the loading indicator visible in forced colors mode (#4794) (1d2a0ba)
• megamenu: keep the item arrows visible in forced colors mode (#4802) (f20c247)
• progress: keep the progress bar visible in forced colors mode (#4795) (d9de949)
• radial-progress: keep the ring visible in forced colors mode (#4797) (3647266)
• rating: keep the rating items visible in forced colors mode (#4796) (123ef13)
• timeline: keep the connector lines visible in forced colors mode (#4799) (3f71bf1)

5.7.48 (2026-10-12)

Bug Fixes

• show the indeterminate checkbox mark in forced colors mode like the checked one (#4804) (4f8de95)

Commits

• bf3bac3 chore(release): 5.7.50
• 70043c8 chore(release): 5.7.49
• 1d2a0ba fix(loading): keep the loading indicator visible in forced colors mode (#4794)
• d9de949 fix(progress): keep the progress bar visible in forced colors mode (#4795)
• 123ef13 fix(rating): keep the rating items visible in forced colors mode (#4796)
• 3647266 fix(radial-progress): keep the ring visible in forced colors mode (#4797)
• 3f71bf1 fix(timeline): keep the connector lines visible in forced colors mode (#4799)
• 23b1176 fix(divider): keep the divider line visible in forced colors mode (#4798)
• f20c247 fix(megamenu): keep the item arrows visible in forced colors mode (#4802)
• 662b54b chore(release): 5.7.48
• Additional commits viewable in compare view

Updates dns_cluster from 0.3.0 to 0.3.1

Changelog

Sourced from dns_cluster's changelog.

0.3.1 (2026-10-01)

• Properly look up the hostname of a {basename, query} tuple

Commits

• f7375d6 Release v0.30.1
• 1c54b42 Look up the hostname of a {basename, query} tuple, not the tuple (#25)
• See full diff in compare view

Updates esbuild from 0.10.0 to 0.10.1

Changelog

Sourced from esbuild's changelog.

v0.10.1 (2026-10-19)

• Don't try to compute the target if a :path is configured

Commits

• 06a1ec0 Release v0.10.1
• b44264e Merge pull request #84 from phoenixframework/sd-prefer-path
• 13d73c6 Do not detect the target when :path is configured
• See full diff in compare view

Updates phoenix from 1.8.15 to 1.8.16

Release notes

Sourced from phoenix's releases.

v1.8.16

Bug fixes

• [phoenix.js] Fix a lot of connection handling races (#6867)
• [phoenix.js] Don't treat WebSocket close code 1000 as special (#6880)

Enhancements

• Allow setting max_channels_per_transport in Phoenix.Endpoint.socket/3

Changelog

Sourced from phoenix's changelog.

Changelog for v1.9

Bug fixes

• [Phoenix.ChannelTest] Fix test sockets violating the Phoenix.Socket.t typespec, which made Dialyzer treat every test join as never returning (#5509)
• [Phoenix.Socket] Type topic and channel_pid as possibly nil in Phoenix.Socket.t, as they are before a channel is joined

Enhancements

• The longpoll session token is now sent in a x-phoenix-longpoll-token header instead of the query string. If you do rolling deploys where both old and new nodes are active at the same time, ensure that you deploy Phoenix v1.8.10 or a later v1.8 release first.
• Channels now use the Phoenix.PubSub.Sender behaviour for fastlaning, which requires phoenix_pubsub v2.4. If you do rolling deploys where both old and new nodes are active at the same time, ensure that you deploy Phoenix v1.8.16 or a later v1.8 release first.

v1.8

The CHANGELOG for v1.8 releases can be found in the v1.8 branch.

Commits

• b502666 Release v1.8.16
• cd67060 Update assets
• 673192b Don't treat code 1000 as special (#6880)
• d74649e Fix Route.build/14 spec for hosts and helper (#6879)
• 29e4caf Remove redundant text in @​deprecated messages (#6876)
• c0787d6 Update assets
• 3909a22 Address connection races (#6867)
• f94b39c Fix broken asset management anchors in directory structure guide (#6872)
• 512c502 allow setting max_channels_per_transport on the socket in endpoint (#6871)
• 58d534e Ensure all socket options are validated
• Additional commits viewable in compare view

Updates phoenix_live_view from 1.2.12 to 1.2.13

Release notes

Sourced from phoenix_live_view's releases.

v1.2.13

Bug fixes

• Handle file reader upload error (#4449)
• Fix updates inside a hooked <svg> element (#4456)
• Fix unload for submitter formtarget (#4453)
• Wait for all ancestor looks before auto upload (#4454)
• Fix form recovery completion ordering (#4451)
• Handle chunk push timeouts in uploads (#4452)
• Respect live link target and download attributes on child clicks (#4466)
• Complete errored uploads and release form loading refs (#4468)
• Clear pending disconnected timer before scheduling another (#4464)
• Clear reload status cookie on next request (#4475)
• Only retry focus if it did not move (#4480)

Enhancements

• Handle outdated or dangling symlinks for colocated assets (#4450)
• Forward LiveView socket options to use Phoenix.Socket (#4470)
• Add diagnostic for blocked upload submits (#4472)
• Document that onDocumentPatch must call start in order (#4462)
• Only mark global attributes as changed when they change (#4478)

Changelog

Sourced from phoenix_live_view's changelog.

v1.2.13 (2026-10-20)

Bug fixes

• Handle file reader upload error (#4449)
• Fix updates inside a hooked <svg> element (#4456)
• Fix unload for submitter formtarget (#4453)
• Wait for all ancestor looks before auto upload (#4454)
• Fix form recovery completion ordering (#4451)
• Handle chunk push timeouts in uploads (#4452)
• Respect live link target and download attributes on child clicks (#4466)
• Complete errored uploads and release form loading refs (#4468)
• Clear pending disconnected timer before scheduling another (#4464)
• Clear reload status cookie on next request (#4475)
• Only retry focus if it did not move (#4480)

Enhancements

• Handle outdated or dangling symlinks for colocated assets (#4450)
• Forward LiveView socket options to use Phoenix.Socket (#4470)
• Add diagnostic for blocked upload submits (#4472)
• Document that onDocumentPatch must call start in order (#4462)
• Only mark global attributes as changed when they change (#4478)

Commits

• d8252e1 Release v1.2.13
• 71d337e Update assets
• 3105889 update deps
• 047758c fix test
• 91b6cbd Retry focus if it did not move (#4480)
• 3621eb7 Only mark global attributes as changed when they change (#4478)
• 2447c5c clear reload status on next request (#4475)
• 60b34f2 Document that onDocumentPatch must call start in order (#4462)
• e2dfcd2 Clear pending disconnected timer before scheduling another (#4464)
• 8ee880d Add diagnostic log for blocked upload submits (#4472)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[kyleswiger]

**Nightly triage 2026-10-30:** 🔴 BLOCKED — claude-review job still failing after rerun; CI jobs green, merge state blocked.

---

Generated by Claude Code

[kyleswiger]

🤖 Gemini Automated Code Review

Reviewed automatically by Gemini PR Reviewer

📌 Executive Summary

This PR is an automated dependency update generated by Dependabot, bumping minor and patch releases across six Hex/Git dependencies (bandit, daisyui, dns_cluster, esbuild, phoenix, and phoenix_live_view) along with their transitive locked dependencies (phoenix_pubsub, thousand_island, plug_crypto, elixir_make). Overall risk is low, as the upgrades consist primarily of standard bug fixes, performance optimizations, and security patches (e.g., HTTP/1 & HTTP/2 conformance/security fixes in bandit).

---

🔍 Key Findings & Assessment

🔴 Critical / Blockers

None identified. The dependency versions updated are all patch/minor bumps with backwards-compatible signatures.

🟡 Improvements & Suggestions

• Rolling Deployment Awareness (phoenix + phoenix_pubsub): Phoenix 1.8.16 upgrades phoenix_pubsub to ~> 2.4 due to Phoenix.PubSub.Sender fastlaning changes. If running a multi-node distributed cluster with zero-downtime rolling deploys, ensure all nodes are updated together or verified for compatibility during deployment.
• CI & Asset Verification: Given updates to phoenix_live_view (v1.2.13), esbuild (0.10.1), and daisyui (v5.7.50), verify that client-side asset compilation (mix assets.deploy / JS bundling) and integration tests pass cleanly.

🟢 Positives

• Security Hardening: bandit 1.13.1 resolves authority validation issues (GHSA-v53v-9hvg-37jf) and bounds HTTP/2 window send limits (GHSA-69m6-wcv4-rwcf).
• Bug Fixes: phoenix 1.8.16 resolves connection race conditions in phoenix.js, and phoenix_live_view 1.2.13 fixes SVG element hook updates and upload error recovery.

---

📝 Detailed File-by-File Review

mix.exs

The Git tag reference for daisyui is updated from v5.7.47 to v5.7.50.

@@ -56,7 +56,7 @@ defmodule BeamTestbed.MixProject do
        depth: 1},
       {:daisyui,
        github: "saadeghi/daisyui",
-       tag: "v5.7.47",
+       tag: "v5.7.50",
        sparse: "packages/bundle",
        app: false,
        compile: false,

Assessment: Clean and standard tag update matching mix.lock.

---

mix.lock

Locks are updated for direct dependencies and their transitive requirements (thousand_island 1.6.0 for bandit 1.13.1, phoenix_pubsub 2.4.1 for phoenix 1.8.16, elixir_make 0.10.1).

Assessment: Hashes match expected Hex releases. No manual modifications required.

---

🤖 AI Assistant Copy-Paste Directive

<PR_REVIEW_ACTIONS>
- [ ] Task 1: Fetch updated dependencies using `mix deps.get`.
- [ ] Task 2: Verify project compilation with `mix compile --warnings-as-errors`.
- [ ] Task 3: Run full test suite using `mix test` to confirm no regressions with Phoenix LiveView 1.2.13 and Phoenix 1.8.16.
- [ ] Task 4: Verify asset build pipeline execution (e.g., `mix assets.build` or target npm/esbuild script).
</PR_REVIEW_ACTIONS>