deps(elixir): bump the elixir-query-service group across 1 directory with 4 updates

[dependabot]

Bumps the elixir-query-service group with 4 updates in the /apps/query-service directory: bandit, credo, ex_doc and phoenix.

Updates bandit from 1.10.2 to 1.10.3

Changelog

Sourced from bandit's changelog.

1.10.3 (22 Feb 2026)

Enhancements

• Support authority form requests for CONNECT requests (#571)
• Narrow acceptance of asterisk form requests to OPTIONS requests (#571)
• Detect client disconnect on timeout in ensure_completed (#566, thanks @​pepicrft!)
• Improve http2 sendfile streaming (#565, thanks @​elibosley!)

Commits

• e3fd682 Version bump to 1.10.3
• a330b13 Grant actions:write permission to lint job for PLT cache eviction
• 0aa42c2 Support authority form requests for CONNECT requests (#571)
• ac63021 fix: detect client disconnect on timeout in ensure_completed (#566)
• c746d8e Bump ex_doc from 0.40.0 to 0.40.1 (#569)
• 5640a10 Bump credo from 1.7.15 to 1.7.16 (#568)
• 78e5184 feat: http2 sendfile streaming (#565)
• See full diff in compare view

Updates credo from 1.7.13 to 1.7.16

Release notes

Sourced from credo's releases.

v1.7.16

Check it out on Hex: https://hex.pm/packages/credo/1.7.16

• Fix compatibility & compiler warnings with Elixir 1.20.0-rc.1
• Credo.Check.Refactor.PassAsyncInTestCases add new param :force_comment_on_explicit_false (defaults to false)
• Credo.Check.Warning.Dbg add new param :allow_captures (defaults to false)
• New Check: Credo.Check.Warning.UnusedMapOperation
• New Check: Credo.Check.Warning.UnusedOperation

v1.7.15

Check it out on Hex: https://hex.pm/packages/credo/1.7.15

• Improve performance on large projects
• Parse token_metadata for source files
• Credo.Check.Warning.ExpensiveEmptyEnumCheck have better issue messages
• Credo.Check.Refactor.MatchInCondition add new param :allow_operators
• Credo.Check.Refactor.MatchInCondition fix false positive
• Credo.Check.Readability.AliasOrder fix false positive
• Credo.Check.Readability.FunctionNames fix false positive
• Credo.Check.Readability.SinglePipe add new param :allow_blocks (defaults to true)
• Credo.Check.Refactor.ModuleDependencies fix false positive

v1.7.14

Check it out on Hex: https://hex.pm/packages/credo/1.7.14

• Fixed regression for DuplicatedCode
• Expanded Credo.Check.Warning.ExpensiveEmptyEnumCheck to cover less obvious cases
• New Check: Credo.Check.Warning.StructFieldAmount

Changelog

Sourced from credo's changelog.

1.7.16

• Fix compatibility & compiler warnings with Elixir 1.20.0-rc.1
• Credo.Check.Refactor.PassAsyncInTestCases add new param :force_comment_on_explicit_false (defaults to false)
• Credo.Check.Warning.Dbg add new param :allow_captures (defaults to false)
• New Check: Credo.Check.Warning.UnusedMapOperation
• New Check: Credo.Check.Warning.UnusedOperation

1.7.15

• Improve performance on large projects
• Parse token_metadata for source files
• Credo.Check.Warning.ExpensiveEmptyEnumCheck have better issue messages
• Credo.Check.Refactor.MatchInCondition add new param :allow_operators
• Credo.Check.Refactor.MatchInCondition fix false positive
• Credo.Check.Readability.AliasOrder fix false positive
• Credo.Check.Readability.FunctionNames fix false positive
• Credo.Check.Readability.SinglePipe add new param :allow_blocks (defaults to true)
• Credo.Check.Refactor.ModuleDependencies fix false positive

1.7.14

• Fix regression for DuplicatedCode
• Expand Credo.Check.Warning.ExpensiveEmptyEnumCheck to cover less obvious cases
• New Check: Credo.Check.Warning.StructFieldAmount

Commits

• df52d23 Bump version to 1.7.16
• 3d7a39d Update CHANGELOG
• 8787f8a Upgrade to Elixir 1.20.0-rc.1
• 27f14b2 Rename param to :allow_captures
• 7b80669 Add :allow_capture param to Credo.Check.Warning.Dbg
• b10673d Merge branch 'fix-dbg-ampeprsand-usage' of github.com:Nezteb/credo into 1158-...
• 2f9a47c Merge pull request #1245 from whatyouhide/andrea-expand-docs
• 23c7dce FIXUP
• 2bd5d14 FIXUP
• 276f0a7 Expand compile-time strings in "use Credo.Check" options
• Additional commits viewable in compare view

Updates ex_doc from 0.39.1 to 0.40.1

Changelog

Sourced from ex_doc's changelog.

v0.40.1 (2026-01-31)

• Enhancements

  • Remove link to source from generated .md files
  • Improve word-breaking of module names and sizing of main page titles
  • Include description in llms.txt

• Bug fixes

  • Fix headers in custom groups

v0.40.0 (2026-01-20)

• Enhancements

  • Introduce Markdown formatter (thanks to Yordis Prietro)
  • Generate a llms.txt document by default and add a "Copy Markdown" button to the top of every page
  • Run retriever only once per formatter
  • Support anchors on redirects

• Bug fixes

  • Copy button on erl and iex snippets now include prompts
  • Fix headers having wrong selectors due to whitespace minification
  • Only include .html links on Swup

• Breaking changes

  • Revamp the ExDoc entrypoint and formatter API. While those have never been made public, others may have relied on it. We have now changed and documented them on the path to standardization
  • The previously deprecated :assets option will raise if given a string, pass a map instead

v0.39.3 (2025-12-09)

• Enhancements
  • Add the option to trim down the footer

v0.39.2 (2025-12-04)

• Bug fixes
  • Do not strip hrefs on summaries
  • Show go to latest for prereleases
  • Prevent fake italic in autocomplete text
  • Rename "Search Hexdocs" link to "Go to package docs"

Commits

• 20a355b Release v0.40.1
• 7a71ddf Update assets
• f44f6fe Turn whitespace minification back on
• 3802867 Improve distinction between docstring headings (H2-H4)
• e8a46c6 Change headings' levels to match their context
• 9cd866c Fix Summary Types heading size
• e8e74ee More word break tests
• 21ec71f Update assets
• 8611a16 Improve word-breaking of module names and sizing of main page titles (#2190)
• 1b1fe51 Bump lodash from 4.17.21 to 4.17.23 in /assets (#2187)
• Additional commits viewable in compare view

Updates phoenix from 1.8.3 to 1.8.4

Changelog

Sourced from phoenix's changelog.

1.8.4 (2026-2-23)

JavaScritp Client Bug Fixes

• Fix bug reconnecting connections when close was gracefully initiated by server
• Fix LongPoll transport name in sessionStorage and logs

Enhancements

• Adds guards support in assert_push, assert_broadcast, and assert_reply
• Enable purging in Phoenix code server for Elixir 1.20

Commits

• 5c0f19f Release 1.8.4
• 22ac56e Update assets
• 72192e3 Bump lodash from 4.17.21 to 4.17.23 (#6584)
• 92a79b0 Adds guards support in assert_push, assert_broadcast and assert_reply (#6595)
• ac12eec Fix concurrent socket teardown (#6602)
• 0f6a26f Update umbrella link
• 2dda4b0 Fix @​stream typo in usage-rules liveview streams example (#6601)
• 7c37fa7 Fix bad link (#6597)
• dadf946 followup for phoenixframework/phoenix#6563
• 666dcae Revert "autocomplete with email in email fields (#6502)" (#6574)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, elixir. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
all-source-web	Ready	Preview, Comment	Mar 1, 2026 3:38pm