chore(deps): upgrade Elixir dependencies within their current constraints by darwin67 · Pull Request #82 · chaba-dev/textbin

darwin67 · 2026-10-11T19:55:06Z

This is the first of the dependency-upgrade PRs. It brings every Elixir dependency whose mix.exs constraint already allows a newer release up to date, except lumis. It changes mix.lock, plus one line in mix.exs.

Commit	Upgrades	Notes
decimal	3.1.2 → 3.2.0	The security fix shipped in 3.1.2 (#81). 3.2.0 adds signals and fixes `div/2` rounding. Textbin has no decimal columns.
HTTP client	mint 1.10.2 → 1.11.0, finch 0.23 → 0.24, req 0.7.2 → 0.7.5	These land together. finch 0.24 fixes stale responses reaching the next request after a receive timeout, which happens only with Mint 1.11.
Phoenix	phoenix 1.8.11 → 1.8.15, phoenix_pubsub 2.2 → 2.4.1, phoenix_template 1.0.4 → 1.1.0	phoenix.js fixes reach the browser: Mobile Chrome 149+ reconnecting after a tab resumes, and transport teardown. PubSub 2.4 deprecates custom dispatchers, which Textbin doesn't use.
Misc	swoosh 1.27 → 1.29, telemetry_metrics 1.1 → 1.2, rustler_precompiled 0.9 → 0.10	rustler_precompiled loads lumis's native code. Highlighting still renders.
`build:`	`elixir: "~> 1.15"` → `"~> 1.16"`	phoenix_template 1.1 and rustler_precompiled 0.10 both require Elixir 1.16+, so the declared requirement now matches. CI and the container use 1.20.

Not in this PR

lumis 0.7 → 0.10. ~> 0.3 allows it, but 0.8–0.10 make breaking changes:

lines render as inline spans, which affects line anchors and the theme CSS;
language parsers come from Hex packages and must be installed;
highlight/2 returns exceptions instead of strings.

It goes in the next PR with the upgrades that need constraint changes: phoenix_live_view 1.2, phoenix_live_dashboard 0.9, gettext 1.0 and dns_cluster 0.3. The Rust crates get a separate PR.

Verification

mix precommit passes (582 tests).
The suite also passes with local storage, and with S3 storage against SeaweedFS (the same TEXTBIN_STORAGE_BACKEND/S3_* settings CI's s3 job uses). That covers the new HTTP client stack.
mix compile --warnings-as-errors and mix assets.build pass.
mix deps.get reports no packages with advisories.

🤖 Generated with Claude Code

https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6

Generated by Claude Code

The security fix came in 3.1.2. 3.2.0 adds the :subnormal and :clamped signals, keeps zero results' exponents in range, and fixes div/2 rounding some inexact results the wrong way. Textbin has no decimal columns and never calls Decimal itself; it arrives through Ecto, Postgrex and open_api_spex. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6

These move the HTTP client stack that S3 storage uses to its current releases. They go together because finch 0.24 fixes a bug that appears only with Mint 1.11: after a receive timeout, a connection holding a stale response could go back into the pool and hand that response to the next request. Mint 1.11 carries the same security fixes as 1.10.2. Beyond those, it rejects malformed HTTP/1 status lines and headers and malformed HTTP/2 frames, and it no longer closes a connection on a receive timeout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6

…nix_template to 1.1.0 - phoenix 1.8.12 to 1.8.15 are bug fixes. One makes Mobile Chrome 149+ reconnect after a tab resumes. Another stops phoenix.js from tearing down a replacement transport when the old one closes late. phoenix.js is bundled from deps, so both reach the browser. - phoenix_pubsub 2.4 adds per-subscription senders as the successor to custom dispatchers. Textbin uses neither dispatchers nor :metadata subscriptions, so the API it calls is unchanged. - phoenix_template 1.1 adds an :html_formats option and fixes warnings on recent Elixir versions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6

… rustler_precompiled to 0.10.0 - swoosh 1.28 and 1.29 add adapters and fix the Amazon SES and Customer.io adapters. Textbin uses only the Local and Test adapters in this repository. - telemetry_metrics 1.2 is an enhancement release. - rustler_precompiled 0.10 loads lumis's precompiled NIF. It adds NIF 2.18 for OTP 29, and fixes a silent failure from 0.9 where an existing NIF file was not removed before extraction. Like phoenix_template 1.1, it requires Elixir 1.16 or later. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6

phoenix_template 1.1 and rustler_precompiled 0.10 both require Elixir ~> 1.16, so a project declaring ~> 1.15 can no longer resolve its own lock file on 1.15. This makes the declared requirement match. CI runs 1.20 and the container builds on it, so nothing that ships changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6

This brings the asset toolchain up to date. It is independent of #82, #83 and #84. The Hex `esbuild` and `tailwind` packages were already current; the binary versions in `config/config.exs` and the vendored JS were behind. | Commit | Change | Effect | |---|---|---| | topbar | 3.0.0 → 3.0.1 (vendored) | The canvas gets `role="presentation"` and is hidden with the `hidden` attribute. Checked in Chromium: shown during `phx:page-loading`, hidden afterwards. | | esbuild | 0.25.4 → 0.28.2 | The breaking releases don't touch this build. The binaries now need Linux 3.2+ and macOS 12+. The bundle differs only in esbuild's CommonJS wrapper. | | Tailwind | 4.1.7 → 4.3.3 | Additive utilities, plus a deprecation of `start-*`/`end-*`, which aren't used. CSS is 3.5 KB smaller. This matches what Phoenix 1.8.15 generates. | | daisyUI | 5.0.35 → 5.7.47 (vendored) | No breaking changes flagged. CSS grows by 51 KB raw, **3.7 KB gzipped**, from extra `@supports` fallbacks and state rules. | ### Visual check I screenshotted nine pages in light and dark, at 1280 and 390 px, before and after each CSS change, and diffed the pixels. The pages were login, pastes, new paste, paste detail with highlighting, deleted, workspace settings, search, user settings and orgs. Two runs with no change differed by at most 6 pixels. - **Tailwind:** no real change. The largest difference was 11 pixels of anti-aliasing on a button edge. - **daisyUI** made two small visible changes: - `badge-sm` pills (audience, syntax, expiry) are a few pixels wider, so they sit about 5 px further left on the list and detail pages; - `select` fields have about 4 px less left padding before their text. Nothing else moves. None of the 36 screenshots logged a console or page error. The LiveView flows (create, live navigation, search, delete, restore, socket reconnect) pass on the new bundle. `mix test` passes (582 tests). `assets/vendor/daisyui-theme.js` is not referenced by `app.css`, so it is left as it is. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6 --- _Generated by [Claude Code](https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6)_ --------- Co-authored-by: Claude <noreply@anthropic.com>

…nd dns_cluster (#84) This is stacked on #82. It covers the Elixir upgrades that need a `mix.exs` constraint change. | Commit | Change | Notes | |---|---|---| | dns_cluster | 0.2 → 0.3.1 | Adds SRV queries and fixes `{basename, query}` lookups. Textbin passes a plain query or `:ignore`. | | gettext | 0.26 → 1.0 | No breaking changes. The app already uses the `Gettext.Backend` style. | | **phoenix_live_view** | **1.1.33 → 1.2.12** | **Security:** 1.2.7 fixes CVE-2026-58228 (GHSA-5cgh-g58j-m9cq), a scheme validation bypass in `Phoenix.LiveView.Utils`. The 1.1 changelog lists no backport. 1.1.33 already had the CVE-2026-64941 redirect fix. | | `style:` | HEEx reformat | The 1.2 HTML formatter keeps an empty element's closing tag inline. Two templates change, so `mix format --check-formatted` stays green. | | phoenix_live_dashboard | 0.8.7 → 0.9.1 | Dev-only, mounted at `/dev/dashboard`. | | `build:` lumis | `~> 0.3` → `~> 0.7.0` | Holds lumis back. See below. | ### lumis is held at 0.7, not upgraded From 0.9, lumis no longer bundles parsers. Each language is a separate `lumis_wasm_*` Hex package that wasmtime compiles at runtime. A language without its package renders as plain text and only logs a warning. I tried 0.10.3: every sample (Elixir, JS, Python, Rust, JSON, SQL, YAML) came back uncoloured, with no error. Lines also become `<span>` instead of `<div>`, and the line-number CSS and two tests depend on the `<div>`. The old `~> 0.3` would have let `mix deps.update --all` make that jump silently, so this PR tightens it to `~> 0.7.0`. Doing the upgrade properly means choosing: - which parser packages to ship (the Syntax field is free text, and 0.7 bundles ~110 languages); - a writable `LUMIS_DATA_DIR` for the compiled-module cache in the read-only container; - which parsers to warm at boot. That belongs in its own PR. ### Verification - `mix precommit` passes (582 tests). The suite also passes with S3 storage against SeaweedFS. - `mix deps.unlock --check-unused` is clean, and `mix deps.get` reports no packages with advisories. - LiveView 1.2's JS client in Chromium against the dev server, with no console or page errors: - log in; - create a paste through the `phx-change`/`phx-submit` form, with `push_navigate` to its page; - navigate live back to the list, then search; - delete, then restore from the Deleted tab; - load the settings and orgs pages; - drop and reconnect the socket. - LiveDashboard's home, OS data, metrics, processes and Ecto stats pages load and connect with no client errors. - The suite raises no new LiveView test warnings, including 1.2's new missing-form-id check. Every form has an id. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6 --- _Generated by [Claude Code](https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6)_ --------- Co-authored-by: Claude <noreply@anthropic.com>

claude added 5 commits October 11, 2026 19:47

github-actions Bot added the chore label Oct 11, 2026

This was referenced Oct 11, 2026

chore(deps): upgrade LiveView to 1.2, gettext to 1.0, LiveDashboard and dns_cluster #84

Merged

chore(assets): upgrade esbuild, Tailwind, daisyUI and topbar #85

Merged

darwin67 added this pull request to stack #86 October 11, 2026 22:45

darwin67 marked this pull request as ready for review October 11, 2026 22:46

darwin67 merged commit 9ed1363 into main Oct 11, 2026
17 checks passed

darwin67 deleted the chore/dependency-upgrades branch October 11, 2026 22:46

chaba2-bot Bot mentioned this pull request Oct 11, 2026

chore(release): v0.1.0 #28

Open

Navigation Menu

Repository navigation

chore(deps): upgrade Elixir dependencies within their current constraints - #82

chore(deps): upgrade Elixir dependencies within their current constraints#82
darwin67 merged 5 commits into
mainfrom
chore/dependency-upgrades

darwin67 commented Oct 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

darwin67 commented Oct 11, 2026

Not in this PR

Verification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants