[dependabot]

Bumps the prod group with 2 updates in the / directory: plug and redix.

Updates plug from 1.19.1 to 1.20.3

Changelog

Sourced from plug's changelog.

v1.20.3 (2026-07-09)

Security

• [Plug.Parsers.MULTIPART] Count files and skipped multipart parts towards the length limit (CVE-2026-56814)
• [Plug.Conn.Cookies] Raise if ; is present in cookie attributes (CVE-2026-56813)

v1.20.2 (2026-06-30)

Bug fixes

• [Plug.Conn] Set state to :set_upgrade and status to 101 when running before_send callbacks for upgrades

v1.20.1 (2026-06-23)

Bug fixes

• [Plug.Conn] Fix inform/inform! when atoms are given as header keys

v1.20.0 (2026-06-23)

This release requires Elixir v1.15+.

Enhancements

• [Plug.RequestId] Make request ID generation configurable
• [Plug.Test] Support :sign and :encrypt options in put_req_cookie/4

Bug fixes

• [Plug.Conn] Run before_send callbacks before upgrade_adapter/3
• [Plug.Debugger] Raise if Elixir is compiled without source information
• [Plug.RewriteOn] Rewrite the protocol to HTTPS when x-forwarded-proto is wss
• [Plug.Static] Return 416 for invalid range requests
• [Plug.Static] Fix :raise_on_missing_only raising on non-matching paths with colons

Optimizations

• [Plug.Conn.Cookies] Optimize cookie parsing
• [Plug.Conn.Cookies] Optimize cookie encoding
• [Plug.Conn.Utils] Optimize validate_utf8!/3
• [Plug.Conn.Utils] Optimize splitting by semicolons
• [Plug.Router] Optimize host matching

v1.19.5 (2026-07-09)

Security

• [Plug.Parsers.MULTIPART] Count files and skipped multipart parts towards the length limit (CVE-2026-56814)
• [Plug.Conn.Cookies] Raise if ; is present in cookie attributes (CVE-2026-56813)

... (truncated)

Commits

• 9fa11c8 Release v1.20.3
• eceb831 Raise if ; is present in cookie attributes
• 56edca2 Count files and skipped multiparts towards length
• cf15f0a Release v1.20.2
• 5d0fe88 Fix register_before_send with upgrade_adapter (#1320)
• 1fea083 Release v1.20.1
• 9df2c0a Allow atom header keys in inform/3 (#1318)
• d8d733b Release v1.20.0
• b4aa8a0 Merge commit from fork
• ac94702 Validate headers in inform
• Additional commits viewable in compare view

Updates redix from 1.5.3 to 1.9.1

Changelog

Sourced from redix's changelog.

v1.9.1

• Keep Redix.Cluster node pools when DNS returns a different address or address order for the same hostname. Use all resolved IPv4 and IPv6 addresses to match redirects to known pools, with no DNS lookup in command routing. This results in significant less connection/reconnection churn for setups like AWS ElastiCache in serverless mode.
• Add :changed metadata to [:redix, :cluster, :topology_change]. The event still runs after every successful refresh.
• Node IDs in cluster telemetry now keep hostnames from CLUSTER SLOTS after address mapping, instead of resolved IPs.

v1.9.0

• Add Redix.Cluster.hash_slot/1, which exposes the hashing algorithm used by Redix.Cluster.
• Add :cluster metadata field to connection-specific telemetry events (only if connections are part of a cluster).
• Support for resolving multiple peer addresses from an initial address. Redix now supports two strategies: :system, which tries resolved addresses in the order returned by the system resolver, or :random, which shuffles addresses every time. This comes in conjunction with a new :connect_timeout_allocation option which lets you control how long Redix attempts to connect to each address. This change should improve usage of Redix against some servers, such as AWS ElastiCache in serverless mode.

v1.8.2

• Improve the Redix.Cluster command routing fix from 1.8.1 so that it essentially takes more conditions into consideration, like nodes connections being "stuck" or in a connecting state.

v1.8.1

• Route Redix.Cluster commands around disconnected pool members while another member for the same node remains connected.

v1.8.0

• Introduce the :address_mapper option in Redix.Cluster.

v1.7.0

• Introduce :primary_pool_size and :replica_pool_size options for Redix.Cluster. These let you configure per-node pool size, so that you can increase the Elixir-side concurrency in a Redis Cluster setup. Redis is still single-threaded, so apply this only when it makes sense. Defaults have not changed, so a Redix.Cluster connection started without these explicit options defaults to one connection per primary and one per replica (if :read_from_replicas is set).
• Add a few Redix.Cluster-related telemetry events.

v1.6.0

• Add support for Redis Cluster. This is a major feature and this its first release, so use with care—I only tested it (extensively) in non-production-grade scenarios; it was tested on various synthetic environments (like with AWS ElastiCache and locally via Docker) but it has not seen the horrors of production traffic. See the Redix.Cluster documentation to get started.
• Add Redix.PubSub.ping/2.
• Fix Elixir 1.19/1.20 warnings.
• Add a :readonly option to Redix.start_link/1 that issues READONLY after every (re)connection.
• Add a :health_check_interval option to Redix.start_link/1 that detects half-open connections (the socket is open but the server stopped replying) and reconnects. This fixes slow recovery after a Sentinel failover where the old primary is paused (for example via CLIENT PAUSE): the reconnection re-queries the sentinels and lands on the new primary instead of staying wedged. Defaults to :infinity (disabled).

Bug fixes

• Verify SSL server hostnames the way browsers do (RFC 6125) by default, which accepts the wildcard certificates used by servers such as AWS ElastiCache. This sets :customize_hostname_check automatically; you can still override it (or any other default SSL option) through :socket_opts.

Commits

• 7c6cb60 Release v1.9.1
• 3c931c0 Reduce Redis Cluster pool churn (#350)
• dd7c5c1 Really trim down AGENTS.md
• 240afd2 Release v1.9.0
• d51a48f Support for resolving multiple addresses (#349)
• ab49421 Add :cluster metadata to Telemetry events (#348)
• 440bc41 Expose Redix.Cluster.hash_slot/1 (#347)
• 39ff67c Release v1.8.2
• dc947ee Route cluster commands around unavailable pooled connections
• 7d5184a Release v1.8.1
• Additional commits viewable in compare view