build(deps): bump the runtime-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the runtime-dependencies group with 3 updates in the / directory: bandit, jose and req.

Updates bandit from 1.12.0 to 1.12.5

Changelog

Sourced from bandit's changelog.

1.12.5 (20 Aug 2026)

Changes

• Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532w-jv94) (#671)
• Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings (#665)
• Treat proxy-connection as a connection-specific header in HTTP/2 (#632)
• Return FRAME_SIZE_ERROR for HEADERS/DATA frames too short for their flags (#652)
• Treat abortive-close posix reasons as client closures in logging (#663)

Fixes

• Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) (#670)
• Use PROTOCOL_ERROR for a zero WINDOW_UPDATE increment (#656)
• Reject send_file ranges past EOF instead of emitting a negative Content-Length (#653)
• Reject compressed WebSocket control frames regardless of the fin bit (#651)
• Enforce the RFC9112 chunk-size grammar and reject repeated transfer-encoding (#631)
• Fix typos (#627)
• Fix non-deterministic compile-time code (#646)

Enhancements

• Lazily precompile the invalid-field-value match pattern (#662)
• Add tests for untested configuration options (#659)
• Match the weak-etag prefix W/ explicitly (#657)
• Do not duplicate an existing vary: accept-encoding header (#658)
• Honor the close/keep-alive token inside a comma-separated Connection header (#655)
• Initialize the per-stream receive window from the advertised initial_window_size (#654)
• Keep track of body_length to avoid list iterations (#645)
• Avoid per-header length/1 and option lookups in do_read_headers! (#614) (#626)

1.12.4 (27 July 2026)

Fixes

• Properly send Connection: close header when client requests closure (#617)
• Disallow transfer-encoding on HTTP/1.0 connections (#618)
• Reject requests with multiple Host headers (#619)
• Reject malformed header lines (#620)
• Fix handling of chunk extensions (#621)

Enhancements

• Tighten up CI against supply chain attacks (#623, thanks @​Totara-thib!)
• Reorganize and increase coverage of HTTP/1 tests to better match RFC structure (#616)
• Tolerate a leading newline on HTTP/1 requests (#622)
• Send "100 Continue" interim response before reading body if client requests it (#624)

1.12.3 (25 July 2026)

... (truncated)

Commits

• 9571499 Version bump to 1.12.5
• f6914aa Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532...
• d38cf04 Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) (#670)
• cce7c5f Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings (#...
• eca1713 Fixup recent test noise
• b65c235 Consolidate Plug.Conn.Adapter calling-process tests into adapter_test.exs (#667)
• 4ccc008 Treat abortive-close posix reasons as client closures in logging (#663)
• 274eb55 Lazily precompile the invalid-field-value match pattern (#662)
• 10710de Enforce the chunk-size grammar in a single pass (#661)
• d69202e Unify case-insensitive comma-separated header token checks (#660)
• Additional commits viewable in compare view

Updates jose from 1.11.10 to 1.11.12

Release notes

Sourced from jose's releases.

1.11.12 (2025-11-20)

• Fixes
  • Properly handle nil from Elixir maps when encoding with the builtin json Erlang/OTP module; see #184
  • Drop required Elixir version back from 1.16 -> 1.13; see #185

1.11.11 (2025-11-17)

• Fixes
  • EC key decode/encode issues in OTP 28; see #180, #181, #182, #179
  • EdDSA key issues with OTP 27.1.3+; see #177
• Notes
  • This will hopefully be one of the last 1.x releases, next release will be 2.x

Changelog

Sourced from jose's changelog.

1.11.12 (2025-11-20)

• Fixes
  • Properly handle nil from Elixir maps when encoding with the builtin json Erlang/OTP module; see #184
  • Drop required Elixir version back from 1.16 -> 1.13; see #185

1.11.11 (2025-11-17)

• Fixes
  • EC key decode/encode issues in OTP 28; see #180, #181, #182, #179
  • EdDSA key issues with OTP 27.1.3+; see #177
• Notes
  • This will hopefully be one of the last 1.x releases, next release will be 2.x

Commits

• c8b669c Version 1.11.12
• 07705f5 Fix breaking changes to JSON encoding and Elixir requirements, resolves #184,...
• be56c1e Version 1.11.11
• 25bae5d Update CI Matrix, resolves #175
• d2edf6d Merge branch from couchbasedeps/erlang-jose#2
• b4b2052 Fix EC key conversion for OTP 28, resolves #180, resolves #181, resolves #182...
• 49b5aca Fix: Add EdDSA key support for OTP 27.1.3+
• b635b6d Update rebar.config
• 069ac55 Run 'make format'
• e63bb3b Update erlang.mk and Makefile
• Additional commits viewable in compare view

Updates plug from 1.19.2 to 1.20.3

Changelog

Sourced from plug's changelog.

v1.20.3 (2026-07-09)

Security

• [Plug.Parsers.MULTIPART] Count files and skipped multipart parts towards the length limit (CVE-2026-56814)
• [Plug.Conn.Cookies] Raise if ; is present in cookie attributes (CVE-2026-56813)

v1.20.2 (2026-06-30)

Bug fixes

• [Plug.Conn] Set state to :set_upgrade and status to 101 when running before_send callbacks for upgrades

v1.20.1 (2026-06-23)

Bug fixes

• [Plug.Conn] Fix inform/inform! when atoms are given as header keys

v1.20.0 (2026-06-23)

This release requires Elixir v1.15+.

Enhancements

• [Plug.RequestId] Make request ID generation configurable
• [Plug.Test] Support :sign and :encrypt options in put_req_cookie/4

Bug fixes

• [Plug.Conn] Run before_send callbacks before upgrade_adapter/3
• [Plug.Debugger] Raise if Elixir is compiled without source information
• [Plug.RewriteOn] Rewrite the protocol to HTTPS when x-forwarded-proto is wss
• [Plug.Static] Return 416 for invalid range requests
• [Plug.Static] Fix :raise_on_missing_only raising on non-matching paths with colons

Optimizations

• [Plug.Conn.Cookies] Optimize cookie parsing
• [Plug.Conn.Cookies] Optimize cookie encoding
• [Plug.Conn.Utils] Optimize validate_utf8!/3
• [Plug.Conn.Utils] Optimize splitting by semicolons
• [Plug.Router] Optimize host matching

v1.19.5 (2026-07-09)

Security

• [Plug.Parsers.MULTIPART] Count files and skipped multipart parts towards the length limit (CVE-2026-56814)
• [Plug.Conn.Cookies] Raise if ; is present in cookie attributes (CVE-2026-56813)

... (truncated)

Commits

• 9fa11c8 Release v1.20.3
• eceb831 Raise if ; is present in cookie attributes
• 56edca2 Count files and skipped multiparts towards length
• cf15f0a Release v1.20.2
• 5d0fe88 Fix register_before_send with upgrade_adapter (#1320)
• 1fea083 Release v1.20.1
• 9df2c0a Allow atom header keys in inform/3 (#1318)
• d8d733b Release v1.20.0
• b4aa8a0 Merge commit from fork
• ac94702 Validate headers in inform
• Additional commits viewable in compare view

Updates req from 0.6.1 to 0.7.3

Release notes

Sourced from req's releases.

v0.7.3

• encode_body: Revert "Automatically change GET to POST when request body is set."

v0.7.2

• encode_body: Bring back form_multipart: [{string_name, value}].
• put_aws_sigv4: Fix AWS SigV4 compatibility with Supabase Storage S3.

Changelog

Sourced from req's changelog.

v0.7.3 (2026-08-19)

v0.7.2 (2026-07-31)

• encode_body: Bring back form_multipart: [{string_name, value}].
• [put_aws_sigv4]: Fix AWS SigV4 compatibility with Supabase Storage S3.

v0.7.1 (2026-07-28)

• Deprecate cache: true/cache step. It will be removed in Req v0.8. I plan a comprehensive cache solution for Req v1.0+.

v0.7.0 (2026-07-28)

• [Req]: Add Req.new(req, options).

• [Req]: Treat URL userinfo as Basic Authentication.

• [Req], [Req.Request]: Deprecate adapter: fun in favour of adapter: mod.

• [Req.Request]: (BREAKING CHANGE) Remove current_request_steps field.

• [Req.Request]: Fix redacting remaining auth values.

• (BREAKING CHANGE) Replace run_finch step with [Req.Finch] adapter module.

• (BREAKING CHANGE) Replace put_plug and run_plug steps with [Req.Plug] adapter module.

• [Req.Finch]: Support finch: options.

• [Req.Finch]: Support :request_timeout.

• [Req.Finch]: Fix handling duplicate response headers.

• [Req.Finch]: Deprecate finch: name in favour of finch: [name: name].

• [Req.Finch]: Deprecate pool_timeout: value in favour of finch: [pool_timeout: value].

• [Req.Finch]: Deprecate pool_max_idle_time: value in favour of finch: [pool_max_idle_time: value].

• [Req.Finch]: Deprecate :finch_request.

• [Req.Plug]: Handle individual response body chunks.

• [Req.Plug]: Support non-UTF8 request params.

• [Req.Plug]: Put original request private data in conn.private.

• [Req.Test]: Allow descendant processes.

... (truncated)

Commits

• 2901181 Release v0.7.3
• e857078 Revert "encode_body: Automatically change GET to POST when request body is ...
• c136357 Release v0.7.2
• e9d4ebc Fix AWS SigV4 compatibility with Supabase Storage S3 (#498)
• 168a11e Release v0.7.1
• a9c24a1 Deprecate cache: true/cache step
• 6a4f305 Release v0.7.0
• d770830 Hide body: fun for now
• e450b25 Update CI
• 8123419 Fix flaky httpc into: fun test
• Additional commits viewable in compare view

[github-actions]

TCK 1.0-dev Compatibility Results (experimental)

This run is informational — failures do not block CI.

             A2A TCK Compatibility Report              
═══════════════════════════════════════════════════════
SUT: http://localhost:9999
Timestamp: 2026-08-25T19:34:30.367064+00:00

OVERALL COMPATIBILITY: 71.6%

┌─────────────┬────────┬────────┬─────────┬───────┐
│ Level       │ Passed │ Failed │ Skipped │ Total │
├─────────────┼────────┼────────┼─────────┼───────┤
│ MUST        │     44 │     35 │      35 │   114 │
│ SHOULD      │      2 │      9 │       0 │    11 │
│ MAY         │      2 │      2 │       0 │     4 │
└─────────────┴────────┴────────┴─────────┴───────┘

BY TRANSPORT:
  agent_card:    8/10 ⚠
  grpc:          0/72 (72 skipped) ✓
  jsonrpc:       50/100 (30 skipped) ⚠
  http_json:     3/83 (80 skipped) ✓

FAILED REQUIREMENTS:
  ✗ CARD-CACHE-002 (agent_card): Agent Card response should include an ETag header
  ✗ CARD-CACHE-003 (agent_card): Agent Card response may include a Last-Modified header
  ✗ DM-ART-001 (): Response contains no artifacts
  ✗ DM-MSG-001 (): Expected a Message response, but got a Task or no payload
  ✗ JSONRPC-SSE-002 (): Error code mismatch: expected ContentTypeNotSupportedError (-32005), got ParseError (-32700)
  ✗ JSONRPC-ERR-003 (): error.data is absent — A2A errors MUST include ErrorInfo in data array
  ✗ CORE-MULTI-004 (jsonrpc): Expected error code -32001 (TaskNotFoundError), got -32603
  ✗ CORE-HIST-001 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-HIST-002 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-HIST-003 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-HIST-004 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-HIST-005 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-HIST-006 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-GET-001 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_COMPLETED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-CANCEL-001 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-CANCEL-002 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_COMPLETED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-SEND-002 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_COMPLETED' but got 'TASK_STATE_WORKING'")
  ✗ CORE-MULTI-005 (jsonrpc): ('/home/runner/work/a2a-elixir/a2a-elixir/.tck-v1/tests/compatibility/_task_helpers.py', 98, "Skipped: Expected task state 'TASK_STATE_INPUT_REQUIRED' but got 'TASK_STATE_WORKING'")