[dependabot]

Bumps sobelow from 0.15.0 to 0.16.0.

Release notes

Sourced from sobelow's releases.

v0.16.0

What's Changed

• Improve Sobelow detection, reliability, performance, coverage, and architecture by @​houllette in sobelow/sobelow#47
• Add Github Workflow annotations output format by @​katafrakt in sobelow/sobelow#46
• Fix XSS false positives and harden raw and response-header analysis by @​houllette in sobelow/sobelow#48
• version bump - 0.16.0 by @​houllette in sobelow/sobelow#49

New Contributors

• @​katafrakt made their first contribution in sobelow/sobelow#46

Full Changelog: sobelow/sobelow@v0.15.0...v0.16.0

Changelog

Sourced from sobelow's changelog.

v0.16.0

• Bug fixes
  • XSS.Raw no longer reports calls to a benign local raw helper with the matching arity, including defaults, guards, pipes, captures, and inline HEEx. Local definitions stay within their module; qualified Phoenix calls and implicitly imported template helpers retain detection. Helpers returning dynamic {:safe, value} output or wrapping another raw call retain their caller's original findings, locations, and fingerprints. (#44)
  • XSS.SendResp now recognizes put_resp_header(conn, "content-type", type) on the response connection, including piped, aliased, nested, and assigned calls. HTML, SVG, malformed, and unknown types still report; other XML and PDF document types retain low-confidence findings. Discarded, later, unrelated, locally shadowed, or ambiguously imported setters cannot suppress findings. Known unrelated response headers retain the connection's content type, and MIME parameters do not change its classification. (#45)
  • XSS.Raw now respects explicit imports of unrelated raw helpers. Unknown raw macros and delegates retain detection. Older inline lexical contexts without local-signature metadata remain supported.
  • Invalid project roots, roots with no scannable source files, invalid scan options, and unwritable output files now fail with actionable errors.
  • Repeated scans in the same VM now start with fresh findings, template, and skip state. Malformed sources and templates are skipped with a warning in non-strict mode, and unreadable files are skipped with a warning.
  • Dynamic socket options, literal statements in router pipelines, and access on a literal keyword list no longer abort scans. Unknown socket options produce low-confidence findings.
  • XSS.SendResp now follows the connection passed to each response and its content type before that sink. Later or discarded setters cannot suppress an earlier finding, and rebindings in branches, patterns, callbacks, generators, and call arguments cannot borrow another connection's content type. Unchanged bindings, pins, guards, and explicit setters retain their existing handling.
  • HTTPS and HSTS checks now use effective settings for the scanned application and each endpoint, including ordered overrides and nested keyword merges. One endpoint cannot satisfy another's settings. Dynamic and conditional settings produce low-confidence findings. Empty CSP policies are reported.
  • Enabled sockets now inherit endpoint origin settings from base, production, and runtime configuration, including socket/2 and websocket: true. Explicit socket overrides retain precedence, and disabled WebSockets remain excluded. Defaults are isolated to each endpoint module. Origin allowlists and :conn are recognized; an enabled CSRF check lowers confidence when origin checks are disabled.
  • HEEx comments and script/style text no longer change brace-interpolation scope or introduce findings from literal markup. The phx-no-curly-interpolation directive is recognized as an attribute name; the same text inside another attribute's value cannot suppress findings. Inline columns account for sigil prefixes and heredoc indentation.
  • Module-local use and import declarations now apply only to their own module. Named captures and inline HEEx retain lexical aliases and import

... (truncated)

Commits

• 80b84f4 version bump - 0.16.0
• b5ca40d Harden XSS call resolution and response content-type analysis
• 6cac655 Fix XSS false positives for local raw helpers and response headers
• 56725cd Add GitHub Actions workflow annotations
• c3ba4bd Align unreleased changelog with existing release format
• e0a5bf6 Split parsing and scan orchestration into focused modules
• ff25101 Fix adversarial scan crashes and missed XSS detections
• 4539bc1 Fix socket origin inheritance, HEEx directives, and lockfile aliases
• 468d531 Isolate named processes and configuration in legacy tests
• 86b922f Respect older Elixir metadata in compatibility tests
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9a22fc66-6fd5-43a1-8d94-b6f96333e6d0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ocean]

@dependabot rebase