Bump the production-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the production-dependencies group with 4 updates in the / directory: credo, ex_doc, finch and tesla.

Updates credo from 1.7.18 to 1.7.19

Release notes

Sourced from credo's releases.

v1.17.19

Check it out on Hex: https://hex.pm/packages/credo/1.7.19

• Fix compatibility & compiler warnings with Elixir 1.20.0

Changelog

Sourced from credo's changelog.

1.7.19

• Fix compatibility & compiler warnings with Elixir 1.20.0

Commits

• d4a88d4 Bump version to 1.7.19
• b87f0b6 Update CHANGELOG
• c4ed6df Use mix format
• 9172f39 Fix token error
• a6de9b5 Add reproducing test for #1275
• b726ad4 Run mix format
• ccd27fb Add test for sigil_p position
• 8a03b78 Clean stale deps
• a902c97 Set "old credo" to 1.7.18
• cc2ce91 Update GitHub actions
• Additional commits viewable in compare view

Updates ex_doc from 0.40.2 to 0.40.3

Changelog

Sourced from ex_doc's changelog.

v0.40.3 (2026-05-21)

• Enhancements
  • Add autolinking for Erlang/OTP 29 native records

Commits

• 07a6abc Release v0.40.3
• 02904bb Fix record autolink - and bump CI (#2240)
• See full diff in compare view

Updates finch from 0.22.0 to 0.23.0

Changelog

Sourced from finch's changelog.

v0.23.0 (2026-06-17)

Fixed

• Reject http and https request and pool URLs without hosts before attempting requests #371, fixes #186
• Drop :certs_keys, :certfile, and :keyfile from TCP transport options for HTTP requests to avoid :badarg errors #377
• Fix a race condition when dynamically starting pool supervisors that could return :pool_not_available while workers were still registering #379
• Make the HTTP/2 ALPN negotiation failure assertion compatible with OTP 29 TLS alert capitalization #378

Other

• Update development and test dependencies, including Mint 1.9 #378
• CI: update to Elixir 1.20.1 and Erlang/OTP 29.0.2 and fix Credo issues #378

Commits

• See full diff in compare view

Updates tesla from 1.18.0 to 1.20.0

Release notes

Sourced from tesla's releases.

v1.20.0

1.20.0 (2026-06-05)

Features

• support {:form,data} tagged body tuples (#886) (b1b3b80)

v1.19.0

1.19.0 (2026-06-04)

Features

• finch-adapter: Finch adapter will pass through all supported options (#879) (7609328)
• form-urlencoded: support nested bodies via :brackets option (#878) (f7142e8)

v1.18.3

1.18.3 (2026-06-02)

Important {: .error}

Please be careful using :hackney it is recommended to actually test the application before assuming we did not introduce any breaking changes. Also, be aware of the security vulnerabilities we have fixed in this release. Some of them may cause some unexpected behavior from the middleware depending on the assumptions made by the caller.

Features

• hackney: support hackney 4.x (#880) (c91639b)

Security CVE

• CVE-2026-48598 - Multipart part smuggling via unescaped content-disposition values
• CVE-2026-48597 - Atom exhaustion via untrusted URL scheme
• CVE-2026-48596 - CRLF injection in request Content-Type header via add_content_type_param
• CVE-2026-48595 - Authorization header leaks on cross-origin redirect via case-sensitive filtering
• CVE-2026-48594 - Decompression bomb on response body

v1.18.2

1.18.2 (2026-05-15)

Bug Fixes

• builder: include :assigns and :private in request option type (#876) (f5834c1)

v1.18.1

1.18.1 (2026-05-14)

... (truncated)

Changelog

Sourced from tesla's changelog.

1.20.0 (2026-06-05)

Features

• support {:form,data} tagged body tuples (#886) (b1b3b80)

1.19.0 (2026-06-04)

Features

• finch-adapter: Finch adapter will pass through all supported options (#879) (7609328)
• form-urlencoded: support nested bodies via :brackets option (#878) (f7142e8)

1.18.3 (2026-06-02)

Important {: .error}

Please be careful using :hackney it is recommended to actually test the application before assuming we did not introduce any breaking changes. Also, be aware of the security vulnerabilities we have fixed in this release. Some of them may cause some unexpected behavior from the middleware depending on the assumptions made by the caller.

Features

• hackney: support hackney 4.x (#880) (c91639b)

Security CVE

• CVE-2026-48598 - Multipart part smuggling via unescaped content-disposition values
• CVE-2026-48597 - Atom exhaustion via untrusted URL scheme
• CVE-2026-48596 - CRLF injection in request Content-Type header via add_content_type_param
• CVE-2026-48595 - Authorization header leaks on cross-origin redirect via case-sensitive filtering
• CVE-2026-48594 - Decompression bomb on response body

1.18.2 (2026-05-15)

Bug Fixes

• builder: include :assigns and :private in request option type (#876) (f5834c1)

1.18.1 (2026-05-14)

Bug Fixes

• path-params: raise on missing required path parameter values (#874) (a1dd44b)

Commits

• 901ce60 chore(master): release 1.20.0 (#887)
• b1b3b80 feat: support {:form,data} tagged body tuples (#886)
• 603ea34 chore(master): release 1.19.0 (#885)
• 7609328 feat(finch-adapter): Finch adapter will pass through all supported options (#...
• f7142e8 feat(form-urlencoded): support nested bodies via :brackets option (#878)
• 2d3c800 chore(ci): bump release workflow to Elixir 1.19 / OTP 28 (#884)
• 2eb7a78 chore(master): release 1.18.3 (#883)
• 3a369b8 chore: release 1.18.3
• 340f75b Merge commit from fork
• db963db Merge commit from fork
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.