chore(deps): bump the production-dependencies group with 3 updates

[dependabot]

Bumps the production-dependencies group with 3 updates: igniter, jason and req.

Updates igniter from 0.7.9 to 0.8.2

Release notes

Sourced from igniter's releases.

v0.8.2

Bug Fixes:

• handle empty list in configures_key by Zach Daniel

Improvements:

• Add scoped configure/6 options for runtime env blocks (#385) by RhettPoole

• Send issue output to stderr (#384) by daphnerosepurcell

• allow remapping modules to their file locations w/ regexes (#378) by aheiner2001

• add --except to igniter.upgrade --all (#383) by febarnett3

• intercept --help for igniter.new and other tasks. (#382) by CaydenLords

v0.8.1

Improvements:

• adding hex confirmation for igniter.install (#379) by ESmithByui

• accept content-checking function in assert_creates/3 (#291) by Lars Wikman

v0.8.0

Features:

• add Igniter.Code.Pattern for ExAST-powered pattern matching (#375) by Danila Poyarkov

Bug Fixes:

• tolerate 3-tuple dep entries in recursively_compose_schema (#372) by Matt Pruitt

Changelog

Sourced from igniter's changelog.

v0.8.2 (2026-06-24)

Bug Fixes:

• handle empty list in configures_key by Zach Daniel

Improvements:

• Add scoped configure/6 options for runtime env blocks (#385) by RhettPoole

• Send issue output to stderr (#384) by daphnerosepurcell

• allow remapping modules to their file locations w/ regexes (#378) by aheiner2001

• add --except to igniter.upgrade --all (#383) by febarnett3

• intercept --help for igniter.new and other tasks. (#382) by CaydenLords

v0.8.1 (2026-06-02)

Improvements:

• adding hex confirmation for igniter.install (#379) by ESmithByui

• accept content-checking function in assert_creates/3 (#291) by Lars Wikman

v0.8.0 (2026-05-09)

Features:

• add Igniter.Code.Pattern for ExAST-powered pattern matching (#375) by Danila Poyarkov

Bug Fixes:

• tolerate 3-tuple dep entries in recursively_compose_schema (#372) by Matt Pruitt

Commits

• 0625839 chore: release version v0.8.2
• 021a000 fix: handle empty list in configures_key
• c2a3521 chore: fix test ordering issue
• a060158 chore: format
• 168f64f improvement: Add scoped configure/6 options for runtime env blocks (#385)
• 200d237 improvement: Send issue output to stderr (#384)
• 549e01c improvement: allow remapping modules to their file locations w/ regexes (#378)
• bc3edcd improvement: add --except to igniter.upgrade --all (#383)
• caa4134 improvement: intercept --help for igniter.new and other tasks. (#382)
• b7fb1fc build(deps): bump the production-dependencies group across 1 directory with 4...
• Additional commits viewable in compare view

Updates jason from 1.4.4 to 1.4.5

Changelog

Sourced from jason's changelog.

1.4.5 (05.05.2026)

• Add support for Decimal 3.0

Commits

• 4ede428 Bump v1.4.5
• b8c2185 Fix dialyzer job
• a363975 Modernise CI to currently supported versions
• 243c8a8 Allow decimal 3.0
• c8e8d05 Revert the experimental 1.5 branch and jason_native experiment
• 0e7a3e2 Add example/doctest for Jason.OrderedObject.new/1
• 984bc07 fix broken link
• f775592 Raise if trying to decode decimals without decimal
• 79d59df Remove unneeded workarounds for xref warnings
• baac78e Fix warnings by conditionally compiling Decimal support
• Additional commits viewable in compare view

Updates req from 0.5.17 to 0.6.2

Release notes

Sourced from req's releases.

v0.6.1

• compressed, decompress_body: Disable automatic decompression

  Decompression is now opt-in by setting compressed: true.

v0.6.0

• encode_body: Security fix for :form_multipart header injection (GHSA-px9f-whj3-246m).

  The multipart encoder interpolated the per-part name, filename, and content_type into the part headers without escaping, so an attacker-controlled value could inject extra headers or smuggle additional parts into the request. These values are now escaped per RFC 7578 / WHATWG form-data (", CR, and LF are percent-encoded).

  Thanks to @​PJUllrich for reporting it.

• decode_body: Drop automatic zip/tar/tgz/gz/zst/csv decoding, (GHSA-655f-mp8p-96gv).

  Req previously auto-decoded archive and compressed response bodies (zip, tar, tgz, gz, zst, and csv) based on the server-supplied content-type, materialising the full decompressed contents in memory with no size cap. An attacker-controlled (or redirect-reachable) endpoint could return a tiny "decompression bomb" that expanded to gigabytes and exhausted the node's memory.

  Now only JSON is decoded by default. Other formats are opt-in via the new :decoders option, which defaults to [:json, :json_api]. Setting it replaces the default (include :json to keep JSON decoding), and false disables all decoding:

  # opt into archives (only for endpoints you trust):
  Req.get!(url, decoders: [:json, :zip])
  

  Note: The decoded zip/tar is still list of {filename :: charlist(), contents :: binary} tuples. In the future release, this will be list of {filename :: binary(), contents :: binary()} tuples.

  While automatic CSV decoding wasn't a security issue, the behaviour based on presence/absence of nimble_csv dependency was suprising. CSV support is still built-in but need to be enabled with decoders: [:csv].

... (truncated)

Changelog

Sourced from req's changelog.

v0.6.2 (2026-06-19)

• Use finch ~> 0.21.

v0.6.1 (2026-06-08)

• [compressed], [decompress_body]: Disable automatic decompression

  Decompression is now opt-in by setting compressed: true.

v0.6.0 (2026-06-08)

• [encode_body]: Security fix for :form_multipart header injection (GHSA-px9f-whj3-246m).

  The multipart encoder interpolated the per-part name, filename, and content_type into the part headers without escaping, so an attacker-controlled value could inject extra headers or smuggle additional parts into the request. These values are now escaped per RFC 7578 / WHATWG form-data (", CR, and LF are percent-encoded).

  Thanks to @​PJUllrich for reporting it.

• [decode_body]: Drop automatic zip/tar/tgz/gz/zst/csv decoding, (GHSA-655f-mp8p-96gv).

  Req previously auto-decoded archive and compressed response bodies (zip, tar, tgz, gz, zst, and csv) based on the server-supplied content-type, materialising the full decompressed contents in memory with no size cap. An attacker-controlled (or redirect-reachable) endpoint could return a tiny "decompression bomb" that expanded to gigabytes and exhausted the node's memory.

  Now only JSON is decoded by default. Other formats are opt-in via the new :decoders option, which defaults to [:json, :json_api]. Setting it replaces the default (include :json to keep JSON decoding), and false disables all decoding:

  # opt into archives (only for endpoints you trust):
  Req.get!(url, decoders: [:json, :zip])
  

  Note: The decoded zip/tar is still list of {filename :: charlist(), contents :: binary} tuples. In the future release, this will be list of {filename :: binary(), contents :: binary()} tuples.

  While automatic CSV decoding wasn't a security issue, the behaviour based on presence/absence of nimble_csv dependency was suprising. CSV support is still built-in but need to be enabled with decoders: [:csv].

... (truncated)

Commits

• f2c833c Release v0.6.2
• f082be9 Use finch ~> 0.21
• 36a8252 Release v0.6.1
• ea5506f compressed, decompress_body: Disable automatic decompression
• 8e7425f Release v0.6.0
• 584a490 decode_body: Drop automatic zip/tar/tgz/gz/zst/csv decoding
• 2d77dbe encode_body: Security fix for :form_multipart header injection
• 53c3b99 Release v0.5.18
• dc1f3be Update ex_doc
• dbd145c Update CHANGELOG.md
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[zachdaniel]

@dependabot rebase

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.