deps: bump the hex-minor-patch group with 6 updates

[dependabot]

Bumps the hex-minor-patch group with 6 updates:

Package	From	To
castore	1.0.19	1.0.20
lazy_html	0.1.11	0.1.12
mdex	0.13.3	0.13.4
mint	1.9.1	1.9.3
phoenix_live_view	1.2.6	1.2.7
req	0.6.2	0.6.3

Updates castore from 1.0.19 to 1.0.20

Commits

• d7c27ff Update certificates (#87)
• 7cd9624 Fix elixir 1.20 compilation warnings (#86)
• See full diff in compare view

Updates lazy_html from 0.1.11 to 0.1.12

Release notes

Sourced from lazy_html's releases.

v0.1.12

Changed

• Relaxed elixir_make requirement (#35)

Changelog

Sourced from lazy_html's changelog.

Commits

• f30bc5e Release v0.1.12
• 5e9e3ee Bump otp on ci (#39)
• fd02a1d Do not start elixir_make and fine at runtime (#36)
• bb64356 Relax elixir_make requirement to allow 0.10.0 (#35)
• e65f0cd Update version
• See full diff in compare view

Updates mdex from 0.13.3 to 0.13.4

Release notes

Sourced from mdex's releases.

v0.13.4

0.13.4 (2026-07-17)

Changes

• require mdex_native >= 0.2.6

Features

• update mdex_native and comrak (#377) (7739bf5) and (#382) (f782966)

  • Add LaTeX-style math delimiters with extension: [math_latex: true].
  • Add attribute parsing for headings, fenced code blocks, inline code, links, and images. Enable it with the :header_attributes, :fenced_code_attributes, :inline_code_attributes, and :link_attributes extension options. Parsed attributes are available in the document AST as %MDEx.Attributes{}.
  • Add semantic HTML for alerts with render: [alert_style: :semantic].
  • Heading anchors generated by :header_id_prefix now appear after the heading content, include an accessible aria-label, and are no longer hidden from assistive technology.

• update lumis (#377) (7739bf5)

Changelog

Sourced from mdex's changelog.

0.13.4 (2026-07-17)

Changes

• require mdex_native >= 0.2.6

Features

• update mdex_native and comrak (#377) (7739bf5) and (#382) (f782966)

  • Add LaTeX-style math delimiters with extension: [math_latex: true].
  • Add attribute parsing for headings, fenced code blocks, inline code, links, and images. Enable it with the :header_attributes, :fenced_code_attributes, :inline_code_attributes, and :link_attributes extension options. Parsed attributes are available in the document AST as %MDEx.Attributes{}.
  • Add semantic HTML for alerts with render: [alert_style: :semantic].
  • Heading anchors generated by :header_id_prefix now appear after the heading content, include an accessible aria-label, and are no longer hidden from assistive technology.

• update lumis (#377) (7739bf5)

Commits

• af2bc86 chore(main): release 0.13.4 (#378)
• f782966 feat: update mdex_native (#382)
• 8897bdf chore(deps): bump phoenix_live_view from 1.2.6 to 1.2.7 (#381)
• 7739bf5 deps: update mdex_native and lumis (#377)
• afd066e chore(deps): bump phoenix_live_view from 1.2.5 to 1.2.6 (#376)
• 26a6f64 docs - comparison
• 219d174 docs - comparison
• See full diff in compare view

Updates mint from 1.9.1 to 1.9.3

Changelog

Sourced from mint's changelog.

v1.9.3

• Prevent signed integers when parsing HTTP/1 chunk sizes. This is a fix for CVE-2026-59249 (GitHub advisory).

v1.9.2

• Cap HTTP/1 total header size for responses. This is a fix for CVE-2026-58229 (GitHub advisory GHSA-qrfr-wh4c-3qhw).
• Do not store empty CONTINUATION (HTTP/2) frames. This is a fix for CVE-2026-59246 (GitHub advisory GHSA-8pf6-g464-h6h9).

Commits

• f0b72c0 Release v1.9.3
• fc7d165 Merge commit from fork
• 5cbf7a3 Merge commit from fork
• d066c66 Fix Dialyzer
• 0622056 Release v1.9.2
• 566d702 Merge commit from fork
• 5779de1 Merge commit from fork
• bc63e9b Bump Elixir/Erlang versions in CI (#490)
• See full diff in compare view

Updates phoenix_live_view from 1.2.6 to 1.2.7

Release notes

Sourced from phoenix_live_view's releases.

v1.2.7

Security fixes

• CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

Changelog

Sourced from phoenix_live_view's changelog.

v1.2.7 (2026-07-13)

Security fixes

• CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

Commits

• 2570f65 update node
• 0aa35cd Release v1.2.7
• 8616553 revert 4b63216, add test
• dacbd15 Update support information for LV version 1.2
• b0946d5 Update assets
• 716dab9 Don't set clientsideIdAttribute if ID is the same (#4327)
• See full diff in compare view

Updates req from 0.6.2 to 0.6.3

Changelog

Sourced from req's changelog.

v0.6.3 (2026-07-16)

• [Req.Test]: Fix race condition

Commits

• ed7b543 Release v0.6.3
• a3a7bf3 Fix bug when Req.Test.fetch_plug/1 called after mode set to shared (#528)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.