[dependabot]

Bumps the elixir-minor group with 1 update: bandit.

Updates bandit from 1.12.5 to 1.13.1

Changelog

Sourced from bandit's changelog.

1.13.1 (15 Oct 2026)

Reverts

• Revert the stale conn check added in 1.13.0 (#668), since a number of valid code paths in Phoenix depend on stale conns (notably, Plug.Parsers errors rendered by Phoenix.Endpoint.RenderErrors). See elixir-plug/plug#1331

1.13.0 (15 Oct 2026)

Enhancements

• Add a compress_chunked option to compress chunked responses with gzip and zstd (#707, thanks @​iStefo!)
• Clarify inet6 option behaviour on dual-stack platforms (#709, #700, thanks @​adelton!)
• Unroll WebSocket masking over 32-byte blocks (#674, thanks @​mpettibone!)
• Drain HTTP/2 pending sends without repeated List.delete/2 (#673, thanks @​mpettibone!)
• Short-circuit header token lookup on the first match (#699, thanks @​claytongentry!)
• Scope the workflow tokens to what each job actually uses (#702, thanks @​Totara-thib!)
• Add a Plumber check and score badge (#712, thanks @​Totara-thib!)
• Fix recent releases changelog headings in docs (#672, thanks @​dinokovac-river!)

Changes

• Require Thousand Island 1.6, and use the peername it now captures when it accepts a connection (#718)
• Require hpax 1.1 and drop the nil field value workaround (#706, thanks @​acrogenesis!)
• Report conn.port as an integer for CONNECT requests, as Plug.Conn requires
• Close idle connections which send no bytes silently instead of answering 408 (#689, thanks @​tomciopp!)
• RFC Conformance: Enforce Host requirements for HTTP/1.1 targets (#679, thanks @​mpettibone!)
• RFC Conformance: Complete HTTP/2 field validation (#680, thanks @​mpettibone!)
• RFC Conformance: Validate HTTP/2 content length on initial END_STREAM (#681, thanks @​mpettibone!)
• RFC Conformance: Enforce HTTP/2 trailer field section requirements (#682, thanks @​mpettibone!)
• RFC Conformance: Validate request transfer coding before Plug dispatch (#683, thanks @​mpettibone!)
• RFC Conformance: Fix HTTP/1.0 streaming response framing (#684, thanks @​mpettibone!)
• RFC Conformance: Accept empty non-final WebSocket continuation frames (#685, thanks @​mpettibone!)
• RFC Conformance: Validate WebSocket client keys (#686, thanks @​mpettibone!)

Fixes

• Validate the authority of HTTP/1 absolute-form and authority-form request targets against the same grammar as the Host header (GHSA-v53v-9hvg-37jf, thanks @​euriconicacio!)
• Bound HTTP/2 sends blocked on a send window by progress, so that a trickle of window updates can no longer keep a stream pinned indefinitely (GHSA-69m6-wcv4-rwcf, thanks @​tomciopp!)
• Reject control bytes in HTTP/1 request targets (#713, #711, thanks @​PJUllrich!)
• Fix crash when a client resets an HTTP/1 connection before Bandit reads its peer address (#718, #717, thanks @​mhsdef!)
• Drain all queued HTTP/2 DATA frames of an unread body once a response has been sent (#710, #697, thanks @​jamilbk!)
• Preserve independent error responses on HTTP/1 keep-alive and pipelined requests, and frame empty 4xx/5xx error responses with Content-Length: 0 (#705, thanks @​jeregrine!)
• Close instead of draining when a plug never honors Expect: 100-continue (#695, thanks @​tomciopp!)
• Fix chunked read_body(length: 0) falsely completing the body (#691, thanks @​tomciopp!)
• Observe RST_STREAM while blocked on the stream send window (#688, thanks @​tomciopp!)

... (truncated)

Commits

• ee75d31 Version bump to 1.13.1
• 84e9d1d Revert "Guard against stale conn reuse in Bandit.Adapter (#668)" (#719)
• d6daa4a Version bump to 1.13.0
• 02a3853 Add a Plumber check and score badge (#712)
• 0c53a6e Require Thousand Island 1.6 and use its cached peername (#718)
• 8993dae Bump finch from 0.21.0 to 0.24.0 (#716)
• 6ea8021 Merge commit from fork
• 2758910 Bump req from 0.7.4 to 0.7.5 (#715)
• 70014a0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#714)
• c95938d Reject control bytes in HTTP/1 request targets (#713)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 35065017-cb6e-4a0e-ab62-209557b904c8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T21:05:47.349181Z	80d611e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.