Repository navigation
Attempt to fix precendence issue with datetime_add - #182
Merged
Merged
Conversation
SQLite binds `||` tighter than `+`, and `IS`, `IN`, and `=` tighter than `NOT` and `AND`. The generated SQL for `datetime_add`, `is_nil`, `not`, `in`, and update inc dropped parentheses around compound operands, so counts like `a + b` became `NULL`. Fixes: #181
warmwaffles
force-pushed
the
attempt-to-fix-precedence
branch
from
September 20, 2026 15:58
933fb2d to
b095c32
Compare
axelson
added a commit
to axelson/pomodoro_phx
that referenced
this pull request
Nov 3, 2026
…, and 36 others Fixes all security advisories reported by `mix hex.audit` (bandit, lazy_html, phoenix_live_view, swoosh, mint, hpax, plug_crypto, decimal, hackney). - telemetry_metrics constraint widened to ~> 1.0 (no breaking changes) - httpoison overridden to ~> 3.0: :pomodoro pins httpoison ~> 2.0 (unused there), which held hackney on 1.x with open CVEs - gettext stays on 0.26: torch 6.0 requires gettext ~> 0.16 - scenic_widget_contrib (git) a6fd6b5 → 6b14a29 Direct Dependencies: bandit 1.12.3 → 1.14.0 diff: https://diff.hex.pm/diff/bandit/1.12.3..1.14.0 changelog: https://hexdocs.pm/bandit/changelog.html#1-14-0-26-oct-2026 - Security (1.14.0): many HTTP/2, HTTP/1 and WebSocket DoS/smuggling fixes: enforce HTTP/2 receive windows (CVE-2026-108525, GHSA-pxfw-2r8w-g3jv), limit concurrent streams (GHSA-fmr8-qrvr-4ww5), limit header list size (CVE-2026-109584, GHSA-ggpf-wvx5-f4h8), keep HPACK state on stream errors (CVE-2026-111103, GHSA-q48c-59mm-jx3c), plus CVE-2026-115269, -108529, -110499, -111101, -114216 (chunk-extension request smuggling), -113436, -114213, -110314 - Security (1.13.0): validate authority of absolute/authority-form targets (GHSA-v53v-9hvg-37jf); bound HTTP/2 sends blocked on a send window (GHSA-69m6-wcv4-rwcf) - Security (1.12.5): bound/cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532w-jv94); validate HTTP/2 header values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) - Behaviour changes (1.14.0): advertises HTTP/2 `max_concurrent_streams` 500 and `max_header_list_size` 262144 by default; `read_body` can return more than `:length` bytes on HTTP/2; stricter HTTP/1 request-line parsing (e.g. `http://host:80?a=b` now gets 400) - 1.13.0: new `compress_chunked` option (gzip/zstd); requires Thousand Island 1.6 and hpax 1.1; idle connections that send nothing are closed silently instead of getting 408. Many RFC-conformance fixes - 1.12.4: rejects multiple Host headers and malformed header lines; disallows transfer-encoding on HTTP/1.0 elixir_make 0.10.0 → 0.10.1 diff: https://diff.hex.pm/diff/elixir_make/0.10.0..0.10.1 changelog: https://hexdocs.pm/elixir_make/changelog.html#v0-10-1-2026-10-24 - Increase max header length - Surface the real download error instead of a misleading file-not-found esbuild 0.10.0 → 0.10.1 diff: https://diff.hex.pm/diff/esbuild/0.10.0..0.10.1 changelog: https://hexdocs.pm/esbuild/changelog.html#v0-10-1-2026-10-19 - Don't try to compute the target if a `:path` is configured finch 0.20.0 → 0.24.0 diff: https://diff.hex.pm/diff/finch/0.20.0..0.24.0 changelog: https://hexdocs.pm/finch/changelog.html#v0-24-0-2026-09-29 - Breaking (0.22.0): requires Elixir v1.15. Removes the deprecated six-argument `Finch.request` function, old pool configuration options and the `:max_idle_time_exceeded` telemetry event (sneako/finch#348). Errors are standardized as `Finch.error()`, `Finch.HTTPError` and `Finch.TransportError` (sneako/finch#341). Pool metrics now use `Finch.Pool.t()` structs as keys (sneako/finch#342, sneako/finch#368) - 0.22.0: new `:http2` config section, `http+unix://` schemes, pool tagging, dynamic pool APIs (`Finch.start_pool/3`, `Finch.find_pool/2`), `:pool_strategy`, and runtime pool resizing - 0.24.0: support for the HTTP `QUERY` method (sneako/finch#396). HTTP/1 connections are now closed after request/response errors, so stale response refs can't leak into later requests with Mint 1.11 (sneako/finch#397) - 0.21.0: idle HTTP/1 pools are no longer terminated while connections are in use (sneako/finch#292). Unsupported HTTP/2 server push is disabled to avoid crashes (sneako/finch#333) httpoison 2.2.3 → 3.0.0 diff: https://diff.hex.pm/diff/httpoison/2.2.3..3.0.0 changelog: https://github.com/edgurgel/httpoison/blob/main/CHANGELOG.md#300-2026-06-14 - Security: upgrade to hackney 4.0, "which fixes several CVEs (atom-table exhaustion via URL schemes, HTTP header injection, WebSocket buffer limits and more)" - Breaking: redirects are now followed inside hackney, so `HTTPoison.MaybeRedirect` is no longer returned (the struct is kept only for backward compatibility) - Breaking: basic auth over plain HTTP now requires the `insecure_basic_auth: true` option - Response bodies now come straight from hackney; `max_body_length` is trimmed on HTTPoison's side - `ssl: [verify: :verify_none]` disables certificate verification again; empty chunks are skipped when streaming a request body lazy_html 0.1.12 → 0.1.13 diff: https://diff.hex.pm/diff/lazy_html/0.1.12..0.1.13 changelog: https://github.com/dashbitco/lazy_html/blob/main/CHANGELOG.md#v0113-2026-09-25 - Security: fixed `to_html/2` functions to escape `<style>` and `<script>` content inside SVG and MathML (CVE-2026-92106, GHSA-8rqp-v692-v82q) - Added `LazyHTML.css_path/1` for generating queryable document-relative paths for selections logger_backends 1.0.0 → 1.0.1 diff: https://diff.hex.pm/diff/logger_backends/1.0.0..1.0.1 changelog: https://github.com/elixir-lang/logger_backends/blob/main/CHANGELOG.md#v101 - Fix warnings on Elixir 1.20 machete 0.3.11 → 0.3.12 diff: https://diff.hex.pm/diff/machete/0.3.11..0.3.12 changelog: no changelog found (compare: mtrudel/machete@0.3.11...0.3.12) - From the commit list: add number matcher (mtrudel/machete#74); more README examples; dev-dependency bumps phoenix 1.8.9 → 1.8.16 diff: https://diff.hex.pm/diff/phoenix/1.8.9..1.8.16 changelog: https://hexdocs.pm/phoenix/changelog.html#v1-8-16-2026-10-20 - [phoenix.js] Fix a lot of connection handling races (phoenixframework/phoenix#6867). Fix asynchronous transport close tearing down the replacement transport (phoenixframework/phoenix#6852) - Work around Mobile Chrome 149+ not reconnecting after a tab is resumed (phoenixframework/phoenix#6804) - [Channels] Fix channel messages being dropped when they arrive without a join_ref (introduced in 1.8.3) (phoenixframework/phoenix#6800) - Fix Phoenix crashing on boot if Mix is available but not started (phoenixframework/phoenix#6789). Fix spurious "must restart your server" code reloader messages (phoenixframework/phoenix#6753) - Enhancements: `max_channels_per_transport` option in `Phoenix.Endpoint.socket/3`; plugs with options in `pipe_through` (phoenixframework/phoenix#6755); raise when `:router` given to `use Phoenix.VerifiedRoutes` is not a compile-time literal (phoenixframework/phoenix#6806) phoenix_live_dashboard 0.8.7 → 0.9.1 diff: https://diff.hex.pm/diff/phoenix_live_dashboard/0.8.7..0.9.1 changelog: https://github.com/phoenixframework/phoenix_live_dashboard/blob/main/CHANGELOG.md#v091-2026-08-31 - Breaking (0.9.0): requires Phoenix LiveView 1.0+ and Elixir 1.15+ - 0.9.0: compact nested list view for application supervision trees; per-repo Ecto Stats info module override via `{repo, info_module}` in `:ecto_repos`; `refresh_interval` reporting option for charts; process labels shown in application/process views - 0.9.1: skip Ecto repos that cannot be resolved to an extras module phoenix_live_reload 1.6.2 → 1.7.0 diff: https://diff.hex.pm/diff/phoenix_live_reload/1.6.2..1.7.0 changelog: https://hexdocs.pm/phoenix_live_reload/changelog.html#1-7-0-2026-07-29 - Add JavaScript helper function to capture keyboard shortcuts to open HEEx components - Forward log events to window for custom behaviour phoenix_live_view 1.2.7 → 1.2.13 diff: https://diff.hex.pm/diff/phoenix_live_view/1.2.7..1.2.13 changelog: https://hexdocs.pm/phoenix_live_view/changelog.html#v1-2-13-2026-10-20 - Security (1.2.9): CVE-2026-64941, fix open redirect in `redirect/2` via ASCII tab, LF and CR - 1.2.8: client-side navigation can be cancelled via `phx:before-navigate` + `event.preventDefault()` (phoenixframework/phoenix_live_view#4332). Upload tokens are signed as `:local` so node names are not included in them - 1.2.10: many upload fixes (auto uploads with `max_entries`, testing multi-entry uploads, cancelling external uploads on navigation). New `Phoenix.LiveView.navigation_type/2` (phoenixframework/phoenix_live_view#4393). `phx-hook` can be updated dynamically (phoenixframework/phoenix_live_view#4153) - 1.2.11–1.2.12: stale diffs discarded on rejoin (phoenixframework/phoenix_live_view#4405); LiveComponent async tasks cancelled on removal (phoenixframework/phoenix_live_view#4401); lock handling for LiveComponents in nested LiveViews fixed (phoenixframework/phoenix_live_view#4444) - 1.2.13: more upload/form-recovery fixes. LiveView socket options are forwarded to `use Phoenix.Socket` (phoenixframework/phoenix_live_view#4470) swoosh 1.19.8 → 1.29.0 diff: https://diff.hex.pm/diff/swoosh/1.19.8..1.29.0 changelog: https://hexdocs.pm/swoosh/changelog.html#1-29-0 - Security (1.26.3): fix URL path injection via unencoded sender address in MsGraph adapter (GHSA-754j-98wh-57rf / CVE-2026-54893) - Security-ish (1.25.1): escape email content in the mailbox preview UI (swoosh/swoosh#1124) - 1.21.0: bump Elixir requirement to 1.16, Erlang OTP to 26 - New adapters: Resend (1.20.0), MailerSend (1.22.0), Azure Communication Services (1.24.0), `Swoosh.Adapters.Sandbox` (1.25.0), Mailpit (1.26.0), AhaSend (1.27.0), TurboSMTP (1.28.0), authenticated MailChannels Email API (1.29.0) - 1.23.0: `deliver/1` and `deliver/2` are overridable in `Swoosh.Mailer` (swoosh/swoosh#1109). 1.25.2: runtime config takes priority for Mailer (swoosh/swoosh#1134). 1.25.3: supports hackney < 5.0 (swoosh/swoosh#1132) tailwind 0.5.1 → 0.5.2 diff: https://diff.hex.pm/diff/tailwind/0.5.1..0.5.2 changelog: https://hexdocs.pm/tailwind/changelog.html#v0-5-2-2026-10-24 - Allow larger response headers when downloading Tailwind (fixes `{:header_too_long, {:max, 10240}}` on OTP 27+) - Fix typo in error message telemetry_metrics 0.6.2 → 1.2.0 diff: https://diff.hex.pm/diff/telemetry_metrics/0.6.2..1.2.0 changelog: https://github.com/beam-telemetry/telemetry_metrics/blob/main/CHANGELOG.md#120 - 1.0.0: "No changes. API is considered stable." The changelog lists no breaking changes for the major bump - 1.1.0: support for measurements as the second argument of the keep/drop callback - 1.2.0: support for functions in `tags` (this supersedes `tag_values`); assorted optimizations Transitive Dependencies: boundary 0.10.4 → 0.11.0 — diff: https://diff.hex.pm/diff/boundary/0.10.4..0.11.0 · changelog: https://github.com/sasa1977/boundary/blob/master/CHANGELOG.md#0110 — `exports: all` now exports all exports of sub-boundaries; fixed a crash in the visualize funs task certifi 2.15.0 → 2.18.0 — diff: https://diff.hex.pm/diff/certifi/2.15.0..2.18.0 · changelog: https://hexdocs.pm/certifi/changelog.html#2-18-0-2026-10-23 — Mozilla CA bundle refreshes (latest: curl's 2026-10-20 bundle); drops distrusted Entrust and emSign C1/C3/G3 roots circular_buffer 1.0.0 → 1.1.0 — diff: https://diff.hex.pm/diff/circular_buffer/1.0.0..1.1.0 · changelog: https://hexdocs.pm/circular_buffer/changelog.html#v1-1-0 — adds CircularBuffer.new/2 from an enumerable, max_size/1 and zero-length buffers; ~13% faster insertion on overflow crontab 1.2.0 → 1.2.1 — diff: https://diff.hex.pm/diff/crontab/1.2.0..1.2.1 · changelog: https://github.com/maennchen/crontab/releases/tag/v1.2.1 — fix year field parse failure on invalid input (maennchen/crontab#173); fix Elixir 1.20 warnings decimal 2.4.1 → 3.2.0 — diff: https://diff.hex.pm/diff/decimal/2.4.1..3.2.0 · changelog: https://github.com/ericmj/decimal/blob/main/CHANGELOG.md#v320-2026-10-10 — security: fixes CVE-2026-32686 (3.0.0, decimal128 limits on by default) and CVE-2026-97853 (3.1.2, round/3 memory exhaustion); BREAKING 3.0 defaults: precision 34, parse/cast reject >34 digits or |exp| >6144; 3.2.0 is much faster and fixes many rounding bugs ecto 3.13.6 → 3.14.2 — diff: https://diff.hex.pm/diff/ecto/3.13.6..3.14.2 · changelog: https://hexdocs.pm/ecto/changelog.html#v3-14-2-2026-08-14 — UUIDv7 support, Changeset.reorder_assoc/2, :replace_changed upserts, :on_writable_violation; requires decimal v3; redacts repo config from SASL progress reports ecto_sql 3.13.5 → 3.14.0 — diff: https://diff.hex.pm/diff/ecto_sql/3.13.5..3.14.0 · changelog: https://hexdocs.pm/ecto_sql/changelog.html#v3-14-0-2026-05-19 — table modifiers (e.g. UNLOGGED), Safe Ecto Migration guides, fragment tuple sources, labeled sandbox owner process ecto_sqlite3 0.22.0 → 0.26.0 — diff: https://diff.hex.pm/diff/ecto_sqlite3/0.22.0..0.26.0 · changelog: https://github.com/elixir-sqlite/ecto_sqlite3/blob/main/CHANGELOG.md#v0260 — requires decimal ~> 3.0, ecto/ecto_sql ~> 3.14 and exqlite ~> 0.40; adds check constraints and table :modifiers; fixes SQL generation precedence (elixir-sqlite/ecto_sqlite3#182) exqlite 0.33.1 → 0.43.0 — diff: https://diff.hex.pm/diff/exqlite/0.33.1..0.43.0 · changelog: https://hexdocs.pm/exqlite/changelog.html#v0-43-0 — SQLite 3.51.1 → 3.54.1; adds cancel/1, set_busy_timeout/2 and authorizer support; fixes cancel/busy-handler deadlocks; no longer forces journal mode unless specified (0.34.0) h2 (new) 0.12.5 — hex: https://hex.pm/packages/h2/0.12.5 — HTTP/2 protocol library for Erlang; pulled in by hackney 4.x, which hands its HTTP/2 stack to erlang_h2 (also needed by webtransport) hackney 1.25.0 → 4.9.1 — diff: https://diff.hex.pm/diff/hackney/1.25.0..4.9.1 · changelog: https://github.com/benoitc/hackney/blob/master/NEWS.md#491---2026-10-26 — security: 4.0.1 fixes 10 CVEs (CVE-2026-47066…47076: SSRF bypass, CRLF injection, atom exhaustion, unbounded buffers); 4.9.0 fixes a CA-pinning bypass and an incomplete CVE-2026-47076 fix, adds max_body_size (512 MiB default); BREAKING majors: process-per-connection (2.0), body returned in the response tuple (3.0), HTTP/2/3 moved to h2/quic and metrics removed (4.0) hpax 1.0.3 → 1.1.0 — diff: https://diff.hex.pm/diff/hpax/1.0.3..1.1.0 · changelog: https://github.com/elixir-mint/hpax/blob/main/CHANGELOG.md#v110 — security: 1.0.4 fixes CVE-2026-58226 (GHSA-jj2p-32j7-whj2) by capping unbounded HPACK integers; 1.1.0 adds protocol_resize/2 and returns errors instead of raising on malformed input idna 6.1.1 → 7.1.0 — diff: https://diff.hex.pm/diff/idna/6.1.1..7.1.0 · changelog: https://github.com/benoitc/erlang-idna/blob/master/CHANGELOG — Unicode 17.0.0; drops unicode_util_compat (Erlang >= 20 only); fixes recursive UTS-46 character mapping mint 1.7.1 → 1.11.0 — diff: https://diff.hex.pm/diff/mint/1.7.1..1.11.0 · changelog: https://github.com/elixir-mint/mint/blob/main/CHANGELOG.md#v1110 — security: fixes across 1.9.0–1.11.0 for HTTP/1 smuggling/CRLF injection and HTTP/1+HTTP/2 memory/CPU exhaustion (CVE-2026-56810, -58229, -59246, -59249, -82672, -82728, -82729, -91043, -92103, -94194, plus 4 GHSAs in 1.9.0); 1.8.0 raises default HTTP/2 receive windows muontrap 1.6.1 → 1.8.0 — diff: https://diff.hex.pm/diff/muontrap/1.6.1..1.8.0 · changelog: https://hexdocs.pm/muontrap/changelog.html#v1-8-0 — adds :capture_stderr_only (1.7.0) and a MuonTrap.Daemon :wait_for option (1.8.0) parse_trans 3.4.1 → 3.4.2 — diff: https://diff.hex.pm/diff/parse_trans/3.4.1..3.4.2 · changelog: no changelog found (compare: uwiger/parse_trans@3.4.1...d99fb36) — fixes an ambiguous auto-imported error/3 BIF warning; ex_doc docs and typo/CI cleanup phoenix_pubsub 2.2.0 → 2.4.1 — diff: https://diff.hex.pm/diff/phoenix_pubsub/2.2.0..2.4.1 · changelog: https://github.com/phoenixframework/phoenix_pubsub/blob/main/CHANGELOG.md#241-2026-10-08 — Phoenix.PubSub.Sender replaces custom dispatchers (now deprecated); :group_by Registry sharding option; fixes tracker state deletion phoenix_template 1.0.4 → 1.1.0 — diff: https://diff.hex.pm/diff/phoenix_template/1.0.4..1.1.0 · changelog: https://hexdocs.pm/phoenix_template/changelog.html#1-1-0 — adds :html_formats option; fixes warnings on recent Elixir; exports :locals_without_parens for embed_templates plug_crypto 2.2.0 → 2.2.1 — diff: https://diff.hex.pm/diff/plug_crypto/2.2.0..2.2.1 · changelog: https://hexdocs.pm/plug_crypto/changelog.html#v2-2-1-2026-10-23 — security: stops the secret key base from being written to logs on bad args (CVE-2026-105963, GHSA-ffw9-w85g-f2vh) quic (new) 2.1.3 — hex: https://hex.pm/packages/quic/2.1.3 — pure Erlang QUIC implementation (RFC 9000); pulled in by hackney 4.x for HTTP/3 (also needed by webtransport) ring_logger 0.11.4 → 0.11.7 — diff: https://diff.hex.pm/diff/ring_logger/0.11.4..0.11.7 · changelog: https://hexdocs.pm/ring_logger/changelog.html#v0-11-7 — supports LoggerBackends; drops Elixir ≤ 1.14; fixes an OTP 28 hang in RingLogger.next over ssh sched_ex 1.2.0 → 1.2.1 — diff: https://diff.hex.pm/diff/sched_ex/1.2.0..1.2.1 · changelog: no changelog found (compare: SchedEx/SchedEx@1.2.0...1.2.1) — fixes a crash with the default timezone (SchedEx/SchedEx#62); bumps tzdata thousand_island 1.5.0 → 1.6.0 — diff: https://diff.hex.pm/diff/thousand_island/1.5.0..1.6.0 · changelog: https://hexdocs.pm/thousand_island/changelog.html#1-6-0-15-oct-2026 — new handshake_timeout option (default 5 s); acceptor no longer crashes on :emfile/:enfile or transient accept errors; adds status/1 and info/1 introspection tzdata 1.1.4 → 1.2.2 — diff: https://diff.hex.pm/diff/tzdata/1.1.4..1.2.2 · changelog: https://github.com/lau/tzdata/blob/master/CHANGELOG.md#122---2026-09-25 — hackney now optional (on OTP 25+ uses :httpc with OS CA certs) and hackney 4.x supported; ships tzdata 2026d; fixes an OTP 28 compile error and historical zone periods webtransport (new) 0.4.8 — hex: https://hex.pm/packages/webtransport/0.4.8 — WebTransport protocol for Erlang over HTTP/2 and HTTP/3; required by hackney 4.x (itself depends on h2 and quic) websock_adapter 0.5.9 → 0.6.0 — diff: https://diff.hex.pm/diff/websock_adapter/0.5.9..0.6.0 · changelog: https://github.com/phoenixframework/websock_adapter/blob/main/CHANGELOG.md#060-15-apr-2026 — default max_frame_size is now 10MB (was :infinity) (phoenixframework/websock_adapter#22)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SQLite binds
||tighter than+, andIS,IN, and=tighter thanNOTandAND. The generated SQL fordatetime_add,is_nil,not,in, and update inc dropped parentheses around compound operands, so counts likea + bbecameNULL.Fixes: #181