chore(deps): bump sobelow from 0.13.0 to 0.15.0

[dependabot]

Bumps sobelow from 0.13.0 to 0.15.0.

Release notes

Sourced from sobelow's releases.

v0.15.0

What's Changed

• Fix nine crash-class bugs, add end-to-end test coverage, support Elixir 1.20 by @​houllette in sobelow/sobelow#34
• feat: Support inline # sobelow_skip comments on Phoenix router pipelines by @​houllette in sobelow/sobelow#35
• perf: only re-walk files that actually carry a sobelow_skip attribute by @​houllette in sobelow/sobelow#36
• fix: tolerate empty .sobelow-conf files instead of failing the scan by @​houllette in sobelow/sobelow#37
• perf: Run check tasks in parallel by @​s3cur3 in sobelow/sobelow#23
• Reduce churn: Sort lines in .sobelow-skips file by their value instead of the findings’ fingerprints by @​sesamzoo in sobelow/sobelow#24
• Allow possibility to remove missing router warning (issue #25) by @​a-maze-d in sobelow/sobelow#26
• fix: Stop discarding # sobelow_skip comments over whitespace, and warn when one cannot be read by @​houllette in sobelow/sobelow#39
• Fix for Workflow does not contain permissions issue by @​houllette in sobelow/sobelow#41
• fix: Only match unqualified query/query! where Ecto is in scope by @​houllette in sobelow/sobelow#38
• fix: Stop .sobelow-conf from being able to disable the scan by @​houllette in sobelow/sobelow#42
• version bump - 0.15.0 by @​houllette in sobelow/sobelow#43

New Contributors

• @​s3cur3 made their first contribution in sobelow/sobelow#23
• @​sesamzoo made their first contribution in sobelow/sobelow#24
• @​a-maze-d made their first contribution in sobelow/sobelow#26

Full Changelog: sobelow/sobelow@v0.14.1...v0.15.0

v0.14.1

• Enhancements
  • Implicitly use .sobelow-conf if detected in the root directory rather than require --config switch. The --no-config switch is still supported to prevent any settings from being read in from the file if needed.
  • Added guidance for warn_if_outdated option in mix deps
  • Added support for Elixir v1.19.x
• Bug fixes
  • Handled extra config options for app releases in mix.exs
  • Properly handle the use of CLI switches and config file settings in the same run. These would previously clobber each other in unapparent ways leading to confusing behavior. CLI switch take precedence.
  • .sobelow-conf now sorted alphabetically
  • Fix edwarning from zero argument functions
  • Fixed broken skip funcationality
  • Fixed broken GitHub Actions CI
• Misc
  • Typo fix

v0.14.0

• Removed
  • Support for minimum Elixir versions 1.7 - 1.11 (POTENTIALLY BREAKING - only applies if you relied on Elixir 1.7 through 1.11, 1.12+ is still supported)
• Enhancements
  • Added support for multiple variations of SQL.query()
  • Added support for `System.shell' command introduced in Elixir v1.12
  • Ignore runtime config during Config.HSTS
  • Updated developer dependencies (ex_doc & credo)
• Bug fixes

... (truncated)

Changelog

Sourced from sobelow's changelog.

v0.15.0

• Bug fixes
  • Config.Secrets no longer crashes the scan when a secret is written as anything other than a plain double-quoted string. Heredoc values and values containing escaped quotes previously raised a MatchError and aborted the entire run. These secrets are now reported, using the line of the enclosing config call.
  • A corrupt or unreadable version-check cache file no longer aborts the scan. Sobelow previously printed "This does not appear to be a Phoenix application" and exited 0 — a CI gate could pass having scanned nothing.
  • --strict now reports syntax errors instead of raising. It has been broken since Elixir 1.13 changed the error shape returned by Code.string_to_quoted/2. Errors are now reported as file:line:column:.
  • A template that cannot be parsed is now skipped (or reported under --strict) rather than aborting the scan with an EEx.SyntaxError. The error now names the offending template instead of nofile.
  • A malformed .sobelow-conf now produces an actionable message instead of a raw MatchError stacktrace. This mattered more since v0.14.1 began reading the file automatically.
  • An empty, whitespace-only, or comment-only .sobelow-conf is now read as no options rather than aborting the scan. Such a file parses to an empty block instead of a keyword list, so it originally crashed with a FunctionClauseError and then, once that was fixed, exited 1 with a configuration error. Since the file is read automatically, a stray touch .sobelow-conf or a truncated write was enough to break every scan in a project. Contents that cannot be interpreted are still an error.
  • --save-config now stores ignore_files relative to the project root. Absolute paths were previously baked into .sobelow-conf, breaking the committed file on every other machine and in CI.
  • Config.Secrets now reports the line of the secret itself when a config call spans multiple lines. The line search compared a tuple against an integer, so it never worked as intended.
  • An unwritable ~/.sobelow no longer fails a scan.
  • Fixed a string-interpolation typo that rendered dot-access variables as conn.${atom_to_string(field)}.
  • .sobelow-conf keys are now genuinely sorted alphabetically.
  • A .sobelow-conf can no longer stop Sobelow from scanning. --save-config wrote version into every file it generated, so mix sobelow --version --save-config produced a committed file that made every later run print the version and exit 0 — a CI gate reading that as a clean scan. version, details, all-details, save-config, and diff choose what Sobelow does rather than configure a scan, and are now accepted on the command line only. One in the file is ignored, with a warning when it would have changed anything. version is no longer written to the file in the first place.
  • # sobelow_skip comments are no longer thrown away over whitespace. The pattern demanded exactly one space after the # and exactly one before the list, so # sobelow_skip["XSS.Raw"], # sobelow_skip ["XSS.Raw"], and # sobelow_skip [ "XSS.Raw" ] were all ignored — silently, and indistinguishably from a skip that had simply not applied. Spacing around

... (truncated)

Commits

• 4eb7d16 version bump - 0.15.0
• 1a9e9ff fix: Stop .sobelow-conf from being able to disable the scan
• c5e71f7 fix: Only match unqualified query/query! where Ecto is in scope
• d112cc5 Potential fix for code scanning alert no. 1: Workflow does not contain permis...
• cc5721a fix: Stop discarding # sobelow_skip comments over whitespace, and warn
• 23a6ce5 test: Cover pipeline skip scoping across multiple pipelines
• 7578758 fix: handle a disabled router on every resolution path
• eb28ed4 Allow possibility to remove missing router warning (issue #25)
• f7a2aed fix: sort the whole skips file, and by parsed location
• 9a543aa Reduce churn: Sort lines in .sobelow-skips file...
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

✅ PR Validation Summary

Check	Status
PR Validation	✅ Passed
File Analysis	✅ Completed

Next Steps

• ✅ PR validation passed
• ⏳ Waiting for CI tests to complete
• 👀 Ready for review

---

This comment was automatically generated by the PR validation workflow

[github-actions]

✅ PR Validation Summary

Check	Status
PR Validation	✅ Passed
File Analysis	✅ Completed

Next Steps

• ✅ PR validation passed
• ⏳ Waiting for CI tests to complete
• 👀 Ready for review

---

This comment was automatically generated by the PR validation workflow

[dependabot]

A newer version of sobelow exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

[HectorIFC]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[HectorIFC]

@dependabot recreate

[github-actions]

📊 Measured on this branch

Load test	Throughput	Errors	Commit
Node.js	21,083 rec/s	0	b7f9982
Elixir	19,339 rec/s	0	b7f9982

Chaos certification: PASSED at RF 3: 4 faults injected, 1,049 acknowledged writes verified

These numbers are measured, not committed: a shared runner varies enough between runs that
recording them here would put noise in every diff. The published pages are refreshed from
the run on main after this merges.

---

This comment was automatically generated by the results workflow