[dependabot]

Bumps the mix group with 2 updates: phoenix_html and saxy.

Updates phoenix_html from 4.3.0 to 4.4.0

Changelog

Sourced from phoenix_html's changelog.

4.4.0 (2026-10-30)

• Security

  • Validate attribute names to prevent attribute injection for user-supplied attributes (CVE-2026-117645)

• Enhancements

  • Add Phoenix.HTML.json_escape/1 to escape encoded JSON for safe insertion into an HTML script tag

Commits

• 15ba2aa Release v4.4.0
• d9e4e6b validate attribute keys
• 7cbed82 Transition json_escape/5 to 4-arity after escaping (#475)
• 6548938 Add json_escape (#474)
• 677e572 Improve docs
• 309d62e Fix "idiosyncracies" -> "idiosyncrasies" typo (#473)
• b21a2d0 Escape $ in javascript_escape but reinforce template literals are NOT supported
• c1b46f0 Raise on invalid characters in attributes_escape
• See full diff in compare view

Updates saxy from 1.6.1 to 1.7.0

Changelog

Sourced from saxy's changelog.

v1.7.0 - 2026-10-30

• Security: the encoder now rejects input that could inject XML structure.
  • Comments containing -- raise ArgumentError.
  • Processing instructions with an invalid target (or the reserved xml target), or content containing ?>, raise ArgumentError.
  • ]]> inside CDATA is split into adjacent CDATA sections, preserving the text.
• Harden numeric character reference parsing: cap digit length and reject code points outside the XML Char production (#140, #144).
• Fix encoding of numeric character references, now &#x..; and &#..; (#143).
• Handle UTF-8 element names split across chunks (#142).
• Test on Elixir 1.12 to 1.20 and OTP 24 to 29 (#141).

Commits

• 91c6880 Release v1.7.0
• e15eb55 Match reserved processing instruction target case insensitively
• 9d7b18e Use if for processing instruction target validation
• 4aeb80e Reject invalid processing instructions during XML encoding
• 6d12ee1 Reject double hyphens in XML comments
• 71d99fa Split CDATA terminators to prevent XML injection
• 70ea5c6 Test Elixir 1.12 to 1.20 on OTP 24 to 29 (#141)
• 04c9229 Fix char ref follow-up nits (#144)
• cc5ed5f Encode numeric character references with &# (#143)
• b7b9249 Handle UTF-8 element names split across chunks (#142)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions