[dependabot]

Bumps the elixir-query-service group in /apps/query-service with 3 updates: broadway_kafka, hackney and mint.

Updates broadway_kafka from 0.6.1 to 0.7.0

Changelog

Sourced from broadway_kafka's changelog.

v0.7.0 (2026-09-29)

• Support producer concurrency > 1 when using static membership. Before v0.7.0, the member ID was the configured :group_instance_id. The first deploy of v0.7.0 or later changes the ID of each static member (by adding an index, which is what supports greater-than-one producer concurrency); this causes a consumer group rebalance. Kafka also keeps each old member until its session timeout expires (see :session_timeout_seconds), and does not reassign the partitions of that member during that time.

v0.6.2 (2026-09-28)

• Accept :max_rejoin_attempts option in :group_config in BroadwayKafka.Producer.
• Fix offset-commit but that would get partitions stuck, especially when using static memberhsip.

Commits

• eb19b02 Release v0.7.0
• 5b9153f Support producer concurrency > 1 with static membership (#175)
• bacecaf Relax :brod requirement to include 4.7+
• 8063949 Release v0.6.2
• a308788 Fix offset-commit bug that gets partitions stuck (#174)
• c801ad1 Pass through and document :max_rejoin_attempts to :brod (#173)
• See full diff in compare view

Updates hackney from 4.8.1 to 4.8.4

Release notes

Sourced from hackney's releases.

hackney 4.8.4

Fixed

• hackney:close/1 on a shared pooled HTTP/2 connection resets only the caller's own streams. It stopped the connection, failing every other caller's streams on it. The connection still closes itself once idle with no stream open.
• A connection opened without a pool honours connect_timeout above 8 seconds, and a dial that outlives it returns {error, connect_timeout}. The wait was capped at 8 seconds and ended as an exit in the caller. A dial stuck in the transport no longer holds the caller past its deadline either (#945).

hackney 4.8.3

Fixed

• hackney_conn:set_owner/2 works while a streamed request body is being sent. It returned {error, invalid_state}.
• A response body cut short by the server closing the connection is an error. For a chunked or Content-Length body, body/1 returns {error, {closed, Partial}} with the bytes that arrived, and stream_body/1 and async responses end with {error, closed}. They reported a short body as complete. A body with neither still ends when the connection closes.
• An HTTPS request through a CONNECT proxy reached over TLS ({proxy_transport, ssl}) works. The target TLS handshake ran over the proxy TLS socket as if it were plain TCP and failed.
• A pooled connection from hackney:connect/* stays with its caller between requests, and hackney:close/1 checks it back into the pool. It went back to the pool after every response while the caller still used it, so the pool could stop it in the middle of the next request ({error, closed}) or lend it to another process.

hackney 4.8.2

Fixed

• A connection opened without a pool is owned by the process that opened it and closes when that process dies. It was started under hackney_conn_sup and owned by it, so a killed caller left the connection and its socket open until the server closed it (idle_timeout defaults to infinity). Covers request/5 and connect/* with {pool, false}, streamed request bodies, async responses, HTTP proxies, CONNECT and SOCKS5 tunnels, HTTP/2 and HTTP/3, and h2_open/* streams. With stream_to, the stream_to process owns the connection, as before. hackney_conn:set_owner/2 still moves ownership.
• An HTTP/1.1 connection waiting for a response closes within a second of its owner dying. It was blocked in the socket read and noticed only when the response came, the server closed, or recv_timeout expired.
• A CONNECT or SOCKS5 tunnel socket belongs to its connection. It stayed with the process that opened it, so after hackney_conn:set_owner/2 it still

... (truncated)

Changelog

Sourced from hackney's changelog.

4.8.4 - 2026-09-27

Fixed

• hackney:close/1 on a shared pooled HTTP/2 connection resets only the caller's own streams. It stopped the connection, failing every other caller's streams on it. The connection still closes itself once idle with no stream open.
• A connection opened without a pool honours connect_timeout above 8 seconds, and a dial that outlives it returns {error, connect_timeout}. The wait was capped at 8 seconds and ended as an exit in the caller. A dial stuck in the transport no longer holds the caller past its deadline either (#945).

4.8.3 - 2026-09-27

Fixed

• hackney_conn:set_owner/2 works while a streamed request body is being sent. It returned {error, invalid_state}.
• A response body cut short by the server closing the connection is an error. For a chunked or Content-Length body, body/1 returns {error, {closed, Partial}} with the bytes that arrived, and stream_body/1 and async responses end with {error, closed}. They reported a short body as complete. A body with neither still ends when the connection closes.
• An HTTPS request through a CONNECT proxy reached over TLS ({proxy_transport, ssl}) works. The target TLS handshake ran over the proxy TLS socket as if it were plain TCP and failed.
• A pooled connection from hackney:connect/* stays with its caller between requests, and hackney:close/1 checks it back into the pool. It went back to the pool after every response while the caller still used it, so the pool could stop it in the middle of the next request ({error, closed}) or lend it to another process.

4.8.2 - 2026-09-26

Fixed

• A connection opened without a pool is owned by the process that opened it and closes when that process dies. It was started under hackney_conn_sup and owned by it, so a killed caller left the connection and its socket open until the server closed it (idle_timeout defaults to infinity). Covers request/5 and connect/* with {pool, false}, streamed request bodies, async responses, HTTP proxies, CONNECT and SOCKS5 tunnels, HTTP/2 and HTTP/3, and h2_open/* streams. With stream_to, the stream_to process owns the connection, as before. hackney_conn:set_owner/2 still moves

... (truncated)

Commits

• c0d4969 Merge pull request #960 from benoitc/release/4.8.4
• 3c80fae Wait for the pool checkin in h1_request_releases
• 065bd77 Release 4.8.4
• 652073e Merge pull request #959 from benoitc/fix/h2-close-shared
• d2a9982 Honour connect_timeout on a connection opened without a pool
• 93f22b5 Keep a shared HTTP/2 connection open on close/1
• c52f081 Merge pull request #958 from benoitc/release/4.8.3
• 4b720ed Release 4.8.3
• f44dcd9 Merge pull request #957 from benoitc/fix/pooled-reuse-after-body
• 83dd84b Keep a pooled connect/* conn with its caller until close
• Additional commits viewable in compare view

Updates mint from 1.10.1 to 1.11.0

Changelog

Sourced from mint's changelog.

v1.11.0

This is a minor version bump with no breaking changes. Please do upgrade from 1.10.x versions as it contains fixes for three recently-published CVEs.

Security

• Enforce max_header_list_size on the decoded header list in Mint.HTTP2. Previously, only the compressed header block was checked, letting a malicious server use HPACK-indexed cookie fields to make the client allocate about 1 GB per response. This is a fix for CVE-2026-91043 (GitHub advisory GHSA-9x8p-qrf4-jq7g).
• Check the HTTP/2 frame length against max_frame_size before buffering the payload in Mint.HTTP2. Previously, a malicious server could make the client buffer up to 16 MB per connection for a single frame. This is a fix for CVE-2026-92103 (GitHub advisory GHSA-q95c-ccq6-j5j6).
• Use chunked framing in Mint.HTTP1 only when chunked is the final transfer coding, and close the connection after HTTP/1.0 responses with Transfer-Encoding. Previously, a malicious server could frame a response differently from a strict intermediary on a shared connection. This is a fix for CVE-2026-94194 (GitHub advisory GHSA-gvrc-75rc-7gj9).

Bug Fixes and Improvements

• Don't close the connection on a receive timeout.
• Reject invalid HTTP/1 status lines and header fields, and unfold obsolete line folding.
• Apply the line size limit to complete HTTP/1 status and chunk-size lines.
• Fail HTTP/1 requests pipelined behind a response that closes the connection.
• Return errors from Mint.HTTP1.stream_request_body/3 for requests that aren't streaming, instead of raising.
• Return responses before an error in the order they were parsed.
• Bracket IPv6 literal hostnames in the Host header and :authority.
• Keep the caller's :mode in forward-proxy mode.
• Reject HTTP/2 responses with invalid header fields, pseudo-headers or connection-specific headers.
• Reject HTTP/2 response bodies that don't match the content-length header.
• Reject invalid HTTP/2 DATA, padding, SETTINGS and extension frames.
• Return an error instead of {:done, ref} when an HTTP/2 stream is reset with NO_ERROR before the end of the response.
• Validate and track HTTP/2 server push streams.
• Apply the acknowledged HTTP/2 header table size to the decoding table.
• Keep the HTTP/2 receive window in sync when the window shrinks.
• Ignore HTTP/2 WINDOW_UPDATE frames on closed streams.

Commits

• fb850d3 Release v1.11.0
• 2ec8b69 Merge commit from fork
• 20252ca Merge commit from fork
• c7895cb Merge commit from fork
• bf2455f Add fuzz properties for HTTP/1 and HTTP/2 connections (#520)
• 6c531fe Validate and track HTTP/2 server push streams (#519)
• e159932 Validate HTTP/2 response semantics (#518)
• 4d163e4 Enforce the line size limit on complete status and chunk-size lines (#517)
• 65fe496 Validate HTTP/2 DATA, padding, SETTINGS and extension frames (#512)
• f5fced5 Bracket IPv6 literal hostnames in the Host header and :authority (#514)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions