Skip to content

Bump ash from 3.5.34 to 3.5.42 in /server - #960

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/server/ash-3.5.42
Closed

Bump ash from 3.5.34 to 3.5.42 in /server#960
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/hex/server/ash-3.5.42

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 22, 2025

Copy link
Copy Markdown
Contributor

Bumps ash from 3.5.34 to 3.5.42.

Release notes

Sourced from ash's releases.

v3.5.42

Improvements:

v3.5.40

Bug Fixes:

  • update targets to ubuntu-22.04 and extend release list to prevent stuck builds (#2311) by Shahryar Tavakkoli

  • Runtime upsert_fields option is not passed to data layer in certain cases (#2310) by jlgeering

  • if nils_distinct?, consider multitenancy attribute as an upsert key by Zach Daniel

v3.5.39

authorize before before_transaction hooks in bulk actions by @​zachdaniel

This fixes the CVE: CVE-2025-48042. See the GHSA-jj4j-x5ww-cwh9 advisory for more.

Bug Fixes:

  • authorize before before_transaction hooks in bulk actions by @​zachdaniel

  • special case ci_strings as strings in type casting by @​zachdaniel

  • make Ash.PlugHelpers.set_actor/2 typespec accept term as an actor (#2307) by Maciej Malecki

v3.5.38

Bug Fixes:

... (truncated)

Changelog

Sourced from ash's changelog.

v3.5.42 (2025-09-20)

Improvements:

v3.5.41 (2025-09-20)

Bug Fixes:

  • use explicit is_nil check for upsert_condition by @​zachdaniel

  • actually use the mnesia table configured ð�¤¦â��â��ï¸� by @​zachdaniel

  • add missing capabilities to data layer spec by @​zachdaniel

  • Typo in scope documentation (#2328) by @​Munksgaard

  • properly pass action to requires_original_data? in VerifyActionsAtomic (#2327) by Christopher Bonhage

  • avoid crashing on new exception (#2322) by Cyprien Poisson

  • handle validation init errors without overriding them with validation message (#2320) by marot

Improvements:

  • add --setup flag to ash.install to run ash.setup by @​zachdaniel

  • Improve performance of mix tasks that load extensions (#2332) by drtheuns

  • better error message on invalid relationship paths in exists by @​zachdaniel

  • add any builtin validation by @​zachdaniel

  • detect types in get_path expressions by @​zachdaniel

v3.5.40 (2025-09-13)

Bug Fixes:

  • Make Ash.Type.Keyword.dump_to_native return a map. (#2318) by Torkild Gundersen Kjevik

... (truncated)

Commits
  • 529af74 chore: release version v3.5.42
  • 3d068e9 improvement: use delay_task for mix ash.setup
  • 4c58e2a chore: release version v3.5.41
  • 506abb3 improvement: add --setup flag to ash.install to run ash.setup
  • b3f2e60 chore: make credo happy
  • 2bfa163 fix: use explicit is_nil check for upsert_condition
  • 38f0a96 fix: actually use the mnesia table configured 🤦‍♂️
  • f1294a4 chore: clean up credo warning
  • 040d87f improvement: Improve performance of mix tasks that load extensions (#2332)
  • 8009bbe fix: add missing capabilities to data layer spec
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [ash](https://github.com/ash-project/ash) from 3.5.34 to 3.5.42.
- [Release notes](https://github.com/ash-project/ash/releases)
- [Changelog](https://github.com/ash-project/ash/blob/main/CHANGELOG.md)
- [Commits](ash-project/ash@v3.5.34...v3.5.42)

---
updated-dependencies:
- dependency-name: ash
  dependency-version: 3.5.42
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update Elixir code labels Sep 22, 2025
@dependabot
dependabot Bot requested a review from skanderm as a code owner September 22, 2025 12:11
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update Elixir code labels Sep 22, 2025
@paulcretu
paulcretu temporarily deployed to orcasite-pr-960 September 22, 2025 12:14 Inactive
@dependabot @github

dependabot Bot commented on behalf of github Sep 29, 2025

Copy link
Copy Markdown
Contributor Author

Superseded by #964.

@dependabot dependabot Bot closed this Sep 29, 2025
@dependabot
dependabot Bot deleted the dependabot/hex/server/ash-3.5.42 branch September 29, 2025 15:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file elixir Pull requests that update Elixir code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant