Bump the production-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the production-dependencies group with 5 updates in the / directory:

Package	From	To
credo	1.7.18	1.7.19
ex_doc	0.40.2	0.40.3
expression	2.49.0	2.49.1
finch	0.22.0	0.23.0
tesla	1.18.0	1.20.0

Updates credo from 1.7.18 to 1.7.19

Release notes

Sourced from credo's releases.

v1.17.19

Check it out on Hex: https://hex.pm/packages/credo/1.7.19

• Fix compatibility & compiler warnings with Elixir 1.20.0

Changelog

Sourced from credo's changelog.

1.7.19

• Fix compatibility & compiler warnings with Elixir 1.20.0

Commits

• d4a88d4 Bump version to 1.7.19
• b87f0b6 Update CHANGELOG
• c4ed6df Use mix format
• 9172f39 Fix token error
• a6de9b5 Add reproducing test for #1275
• b726ad4 Run mix format
• ccd27fb Add test for sigil_p position
• 8a03b78 Clean stale deps
• a902c97 Set "old credo" to 1.7.18
• cc2ce91 Update GitHub actions
• Additional commits viewable in compare view

Updates ex_doc from 0.40.2 to 0.40.3

Changelog

Sourced from ex_doc's changelog.

v0.40.3 (2026-05-21)

• Enhancements
  • Add autolinking for Erlang/OTP 29 native records

Commits

• 07a6abc Release v0.40.3
• 02904bb Fix record autolink - and bump CI (#2240)
• See full diff in compare view

Updates expression from 2.49.0 to 2.49.1

Release notes

Sourced from expression's releases.

2.49.1

What's Changed

• [Callbacks] Guard against nil arguments to prevent Protocol.UndefinedError (PROD-5800) by @​smn in turnhub/expression#341
• Stringify Time structs as ISO8601 in both engines (PROD-5951) by @​joaothallis in turnhub/expression#344

Full Changelog: turnhub/expression@2.49.0...2.49.1

Commits

• d86bacd Bump README install version to 2.49.1 to match the release tag (#347)
• 9b0aba1 Stringify Time structs as ISO8601 in both engines (PROD-5951) (#344)
• 04ff14d Merge pull request #341 from turnhub/prod-5800-nil-safety-for-callbacks
• d4110e3 Pin GitHub Actions to full-length commit SHAs
• caf7bb1 Guard callbacks against nil arguments to prevent Protocol.UndefinedError cras...
• See full diff in compare view

Updates finch from 0.22.0 to 0.23.0

Changelog

Sourced from finch's changelog.

v0.23.0 (2026-06-17)

Fixed

• Reject http and https request and pool URLs without hosts before attempting requests #371, fixes #186
• Drop :certs_keys, :certfile, and :keyfile from TCP transport options for HTTP requests to avoid :badarg errors #377
• Fix a race condition when dynamically starting pool supervisors that could return :pool_not_available while workers were still registering #379
• Make the HTTP/2 ALPN negotiation failure assertion compatible with OTP 29 TLS alert capitalization #378

Other

• Update development and test dependencies, including Mint 1.9 #378
• CI: update to Elixir 1.20.1 and Erlang/OTP 29.0.2 and fix Credo issues #378

Commits

• See full diff in compare view

Updates tesla from 1.18.0 to 1.20.0

Release notes

Sourced from tesla's releases.

v1.20.0

1.20.0 (2026-06-05)

Features

• support {:form,data} tagged body tuples (#886) (b1b3b80)

v1.19.0

1.19.0 (2026-06-04)

Features

• finch-adapter: Finch adapter will pass through all supported options (#879) (7609328)
• form-urlencoded: support nested bodies via :brackets option (#878) (f7142e8)

v1.18.3

1.18.3 (2026-06-02)

Important {: .error}

Please be careful using :hackney it is recommended to actually test the application before assuming we did not introduce any breaking changes. Also, be aware of the security vulnerabilities we have fixed in this release. Some of them may cause some unexpected behavior from the middleware depending on the assumptions made by the caller.

Features

• hackney: support hackney 4.x (#880) (c91639b)

Security CVE

• CVE-2026-48598 - Multipart part smuggling via unescaped content-disposition values
• CVE-2026-48597 - Atom exhaustion via untrusted URL scheme
• CVE-2026-48596 - CRLF injection in request Content-Type header via add_content_type_param
• CVE-2026-48595 - Authorization header leaks on cross-origin redirect via case-sensitive filtering
• CVE-2026-48594 - Decompression bomb on response body

v1.18.2

1.18.2 (2026-05-15)

Bug Fixes

• builder: include :assigns and :private in request option type (#876) (f5834c1)

v1.18.1

1.18.1 (2026-05-14)

... (truncated)

Changelog

Sourced from tesla's changelog.

1.20.0 (2026-06-05)

Features

• support {:form,data} tagged body tuples (#886) (b1b3b80)

1.19.0 (2026-06-04)

Features

• finch-adapter: Finch adapter will pass through all supported options (#879) (7609328)
• form-urlencoded: support nested bodies via :brackets option (#878) (f7142e8)

1.18.3 (2026-06-02)

Important {: .error}

Please be careful using :hackney it is recommended to actually test the application before assuming we did not introduce any breaking changes. Also, be aware of the security vulnerabilities we have fixed in this release. Some of them may cause some unexpected behavior from the middleware depending on the assumptions made by the caller.

Features

• hackney: support hackney 4.x (#880) (c91639b)

Security CVE

• CVE-2026-48598 - Multipart part smuggling via unescaped content-disposition values
• CVE-2026-48597 - Atom exhaustion via untrusted URL scheme
• CVE-2026-48596 - CRLF injection in request Content-Type header via add_content_type_param
• CVE-2026-48595 - Authorization header leaks on cross-origin redirect via case-sensitive filtering
• CVE-2026-48594 - Decompression bomb on response body

1.18.2 (2026-05-15)

Bug Fixes

• builder: include :assigns and :private in request option type (#876) (f5834c1)

1.18.1 (2026-05-14)

Bug Fixes

• path-params: raise on missing required path parameter values (#874) (a1dd44b)

Commits

• 901ce60 chore(master): release 1.20.0 (#887)
• b1b3b80 feat: support {:form,data} tagged body tuples (#886)
• 603ea34 chore(master): release 1.19.0 (#885)
• 7609328 feat(finch-adapter): Finch adapter will pass through all supported options (#...
• f7142e8 feat(form-urlencoded): support nested bodies via :brackets option (#878)
• 2d3c800 chore(ci): bump release workflow to Elixir 1.19 / OTP 28 (#884)
• 2eb7a78 chore(master): release 1.18.3 (#883)
• 3a369b8 chore: release 1.18.3
• 340f75b Merge commit from fork
• db963db Merge commit from fork
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.