[dependabot]

Bumps the non-security group with 1 update: sobelow.

Updates sobelow from 0.16.0 to 0.18.1

Release notes

Sourced from sobelow's releases.

v0.18.1

What's Changed

• Fix crash on Module.concat with brackets by @​katafrakt in sobelow/sobelow#68
• Prepare v0.18.1 release by @​houllette in sobelow/sobelow#69

Full Changelog: sobelow/sobelow@v0.18.0...v0.18.1

v0.18.0

• Enhancements

  • Add the Crypto category with WeakHash and WeakCipher checks for literal algorithm choices, including Erlang's streaming MD5 initializer.
  • Add Config.TLSVerify to report disabled TLS certificate verification in scanned source and production configuration, including both Hackney insecure option forms. Server and unknown SSL roles receive low confidence. TLS skip fingerprints include the original call AST.
  • Add DOS.Consult for dynamic file selection in :file.consult/1 and :file.path_consult/2, which can create atoms from untrusted term files.
  • Misc.BinToTerm reports Erlang calls with explicit :safe options at medium confidence instead of high, changing --exit high behavior. It also reports Plug's non-executable decoder without proven :safe. Existing finding IDs, source locations, and skip fingerprints are preserved.
  • Add RCE.File for dynamic file selection in Erlang eval and script APIs, including search paths, pipes and captures.
  • The new file-selection and cryptography checks resolve explicit Erlang imports, including pipes, captures and import arity restrictions.
  • Add DOS.ModuleConcat for dynamic module-name atom creation through Module.concat/1,2, including aliases, imports, pipes and captures.
  • Extend DOS.BinToAtom to interpolated atom word sigils (~w(...)a). Existing atom-interpolation findings, IDs and fingerprints are preserved.
  • Add RCE.Compile for dynamic source, ASTs and file selection in Code.compile_string, compile_quoted, compile_file and require_file.
  • Add Crypto.WeakSignature for explicit MD5 and SHA-1 digest selections in Erlang crypto and public-key signature APIs.
  • Add Config.WeakTLS for explicit legacy SSL, TLS and DTLS protocol selections, sharing source discovery, skips and TLS option parsing with Config.TLSVerify without changing existing TLS finding fingerprints.

• Bug fixes

  • Retain imported sinks in pipes without parentheses and parameter labels inside constructed ASTs. Qualified Kernel atom-word sigils are detected. These patterns can produce new findings; existing locations and skip fingerprints are unchanged.
  • TLS checks resolve explicit SSL and Hackney imports within their scope, retaining low confidence for imported SSL server calls. Literal TLS options and weak versions in cons lists and concatenations are retained.

What's Changed

• Add new checks from Jump fork by @​katafrakt in sobelow/sobelow#65
• Add atom construction, compilation, signature, and TLS checks by @​houllette in sobelow/sobelow#66

... (truncated)

Changelog

Sourced from sobelow's changelog.

v0.18.1

• Bug fixes
  • Prevent bracket access on fields and anonymous calls from leaking AST tuples into finding labels and aborting scans, including interpolated input to module-name, atom, compilation and file-selection checks. Chained brackets retain their original input labels, including conn.params confidence. Existing finding source locations and skip fingerprints are unchanged.

v0.18.0

• Enhancements

  • Add the Crypto category with WeakHash and WeakCipher checks for literal algorithm choices, including Erlang's streaming MD5 initializer.
  • Add Config.TLSVerify to report disabled TLS certificate verification in scanned source and production configuration, including both Hackney insecure option forms. Server and unknown SSL roles receive low confidence. TLS skip fingerprints include the original call AST.
  • Add DOS.Consult for dynamic file selection in :file.consult/1 and :file.path_consult/2, which can create atoms from untrusted term files.
  • Misc.BinToTerm reports Erlang calls with explicit :safe options at medium confidence instead of high, changing --exit high behavior. It also reports Plug's non-executable decoder without proven :safe. Existing finding IDs, source locations, and skip fingerprints are preserved.
  • Add RCE.File for dynamic file selection in Erlang eval and script APIs, including search paths, pipes and captures.
  • The new file-selection and cryptography checks resolve explicit Erlang imports, including pipes, captures and import arity restrictions.
  • Add DOS.ModuleConcat for dynamic module-name atom creation through Module.concat/1,2, including aliases, imports, pipes and captures.
  • Extend DOS.BinToAtom to interpolated atom word sigils (~w(...)a). Existing atom-interpolation findings, IDs and fingerprints are preserved.
  • Add RCE.Compile for dynamic source, ASTs and file selection in Code.compile_string, compile_quoted, compile_file and require_file.
  • Add Crypto.WeakSignature for explicit MD5 and SHA-1 digest selections in Erlang crypto and public-key signature APIs.
  • Add Config.WeakTLS for explicit legacy SSL, TLS and DTLS protocol selections, sharing source discovery, skips and TLS option parsing with Config.TLSVerify without changing existing TLS finding fingerprints.

• Bug fixes

  • Retain imported sinks in pipes without parentheses and parameter labels inside constructed ASTs. Qualified Kernel atom-word sigils are detected. These patterns can produce new findings; existing locations and skip fingerprints are unchanged.
  • TLS checks resolve explicit SSL and Hackney imports within their scope, retaining low confidence for imported SSL server calls. Literal TLS options and weak versions in cons lists and concatenations are retained.

v0.17.0

... (truncated)

Commits

• 97796cc Prepare v0.18.1 release
• 1aab6b2 Fix bracket access labels across shared sink extraction
• cfe7137 Fix crash on Module.concat with brackets
• 225c794 Prepare v0.18.0 release
• 43d0cf8 Close adversarial gaps in security sink matching
• d167bc5 Normalize literal module names across supported Elixir releases
• 31496af Add Config.WeakTLS with shared TLS source and option traversal
• 7530d6a Add Crypto.WeakSignature for MD5 and SHA-1 signatures
• aa2b2a0 Add RCE.Compile for source compilation and file loading
• 45bbaf1 Detect interpolated atom word sigils without duplicating atom findings
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Note

Medium Risk
Sobelow 0.18.x can fail or expand CI security scans without changing runtime code; decimal 3.2.0 is a minor transitive update with limited direct impact here.

Overview
Updates mix.lock only: sobelow 0.16.0 → 0.18.1 and transitive decimal 3.1.1 → 3.2.0. No application source changes; mix.exs still pins sobelow at ~> 0.13 for dev/test.

The sobelow jump adds many new static checks (crypto/TLS, dynamic compilation, file consult, Module.concat, and related DOS/RCE rules) plus 0.18.1 crash fixes for bracket/Module.concat AST handling. mix check and CI’s mix sobelow --config will run the newer scanner, so pipelines may report new findings or different severity (e.g. Misc.BinToTerm with explicit :safe).

The decimal bump is a minor lockfile refresh for existing ecto / jason constraints.

^{Reviewed by Cursor Bugbot for commit 9e635f2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[broly-code-security-scanner]

Broly Security Scan

Note

✅ Clean scan
No vulnerabilities detected in this PR.

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (GLM-5.3-Flash) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Attack Hypotheses · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.