chore(deps): bump the prod group with 3 updates

[dependabot]

Bumps the prod group with 3 updates: gun, mint and mox.

Updates gun from 2.5.0 to 2.6.0

Commits

• 9d40b0f Gun 2.6.0
• 2ee5a92 Add a note about Websocket callbacks
• b63b0c5 HTTP/1.1: Don't rescan the buffer for the header block end
• 14168ef Add max_frame_size to bound incoming Websocket messages
• 0ff93de Close the connection on a masked Websocket frame from the server
• 164f444 Apply invalid_request_headers to request line and header names
• 9b10480 Log unexpected Gun events with logger
• 3ad7207 Decode cookie WPT JSON with json:decode/1
• fdbfea9 Set process labels on Gun, pool, and TLS proxy processes
• 54324af Group cookie quotas with maps:groups_from_list/2
• Additional commits viewable in compare view

Updates mint from 1.9.3 to 1.10.0

Changelog

Sourced from mint's changelog.

v1.10.0

This is a minor version bump with no breaking changes. Please do upgrade from 1.9.x versions as it contains fixes for two recently-published CVEs.

Security fixes:

• Set bounds for a HTTP/1 server's returned status line and chunk-extension line. Previous, Mint.HTTP1 would parse these without any size cap, allowing a malicious actor to stream bytes indefinitely, exhausting the client's host memory. This is a fix for CVE-2026-82728 (GitHub advisory GHSA-g83f-2j6r-q6m4).
• Set a bound for chunked responses chunk-size field in Mint.HTTP1, which prevents an attack where the malicious actor could send a chunk size made of a huge run of hex digits and burn CPU on the client host. This is a fix for CVE-2026-82729 (GitHub advisory GHSA-7p8w-j234-7qc8).

New features:

• Support processing HTTP/1.1 headers as they arrive.
• Add support for HTTPS proxies for HTTPS connections.

Bug fixes:

• Send origin Host header for plain-HTTP proxied requests.
• Fix CONNECT response framing and IPv6 authority in tunnel proxies.
• Fix a bug where we would "leak" target options into the proxy connection in forward-proxy mode.
• Return a tunnel timeout error when the CONNECT deadline elapses.
• Fix hostname/address handling in tunnel proxiesFix hostname/address handling in tunnel proxies.
• Use the request target as the CONNECT :authority in Mint.HTTP2.

Commits

• 75c8be1 Release v1.10.0
• bd2a4e7 Merge commit from fork
• 19be555 Merge commit from fork
• d996244 Support processing HTTP/1.1 headers as they arrive (#499)
• 312574b Sort generated functions for deterministic builds (#500)s
• 99ebaca Fix typo in Mint.HTTP docs (#498)
• 7719dd2 Use the request target as the CONNECT :authority in Mint.HTTP2 (#497)
• d9e1824 Fix hostname/address handling in tunnel proxies (#496)
• bc24618 Return a tunnel timeout error when the CONNECT deadline elapses (#495)
• 16d6b56 Add support for HTTPS proxies for HTTPS connections (#492)
• Additional commits viewable in compare view

Updates mox from 1.3.0 to 1.3.2

Changelog

Sourced from mox's changelog.

v1.3.2 (2026-09-11)

• Fix an exception that would be raised in situations where an ancestor of a process in the Mox tree exited.

v1.3.1 (2026-08-31)

• Do not crash verification after an unexpected call in shared mode

Commits

• 7e63914 Release v1.3.2
• 21d76c7 Fix missing parent issue (#178)
• 95f929c Release v1.3.1
• b7a66c1 Fix Mox regression, closes #176
• 7c0245b Simplify CI
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cursor]

PR Summary

Medium Risk
Touches HTTP client stacks used by optional adapters (especially mint security fixes); no application code changes, but runtime HTTP behavior may differ slightly after upgrade.

Overview
Updates mix.lock for the prod dependency group: mint 1.9.3 → 1.10.0, gun 2.5.0 → 2.6.0 (with transitive cowlib 2.19.0 → 2.20.0), and mox 1.3.0 → 1.3.2.

The mint bump is the main operational driver—it backports bounds on HTTP/1 parsing (CVE-2026-82728 / CVE-2026-82729) and proxy/tunnel fixes, which affects optional Finch / mint Tesla adapters. gun brings WebSocket/HTTP hardening and logging tweaks for the optional Gun adapter. mox is test-only stability fixes for mock verification when processes exit.

^{Reviewed by Cursor Bugbot for commit a44875d. Bugbot is set up for automated code reviews on this repo. Configure here.}