Bump mint from 1.7.1 to 1.9.3

[dependabot]

Bumps mint from 1.7.1 to 1.9.3.

Changelog

Sourced from mint's changelog.

v1.9.3

• Prevent signed integers when parsing HTTP/1 chunk sizes. This is a fix for CVE-2026-59249 (GitHub advisory).

v1.9.2

• Cap HTTP/1 total header size for responses. This is a fix for CVE-2026-58229 (GitHub advisory GHSA-qrfr-wh4c-3qhw).
• Do not store empty CONTINUATION (HTTP/2) frames. This is a fix for CVE-2026-59246 (GitHub advisory GHSA-8pf6-g464-h6h9).

v1.9.1

Security

• HTTP/1.1 chunked response bodies are now emitted as {:data, ref, data} tuples as soon as data from the chunked body is received. This prevents CVE-2026-56810: the previous behavior was to buffer body chunks according to their advertised length. An attacker could craft a chunked response with a very large chunk length, and Mint would keep accumulating incoming chunked bytes in memory until reaching that length—allowing the attacker to OOM the application using Mint. See also the GHSA-c59h-fq4p-r36r GitHub advisory.

v1.9.0

Security

• Validate the HTTP/1.1 request method as an RFC 9110 token, rejecting CRLF and other control characters. Forwarding attacker-controlled input as the request method was exposed to CRLF injection (request header injection and request smuggling). Fixes GHSA-2pg6-44cx-c49v.
• Reject HTTP/1.1 content-length header values that are not strictly 1*DIGIT, so signed values (such as +0) and embedded whitespace no longer parse as valid lengths. This parser disagreement with a strict fronting proxy was a response-smuggling primitive. Fixes GHSA-mjqx-c6f6-7rc2.
• Bound the HTTP/2 accumulated header block by the locally advertised SETTINGS_MAX_HEADER_LIST_SIZE (now defaulting to 256 KB instead of :infinity), so a malicious server can no longer exhaust client memory with an unbounded chain of CONTINUATION frames. Fixes GHSA-2p26-p43x-fhp8.
• Count reserved HTTP/2 streams against max_concurrent_streams at PUSH_PROMISE time and refuse promises past the limit with RST_STREAM, so a malicious server can no longer exhaust client memory by flooding PUSH_PROMISE frames. Fixes GHSA-g586-ccqf-7x4r.

Bug Fixes and Improvements

• Mint.HTTP.stream/2 now returns :unknown (not :unknown_message) when given a message it does not recognize.

v1.8.0

New features

• Raise the default HTTP/2 receive windows to 16 MB (connection) and 4 MB (stream), and batch HTTP/2 receive-window refills. The larger windows lift the per-stream throughput cap (window / RTT), giving substantially higher throughput on higher-latency connections, in exchange for higher peak memory use per connection. The connection-level window is now configurable via the new :connection_window_size option to Mint.HTTP.connect/4, and refill batching is configurable via the new :receive_window_update_threshold option.
• Add Mint.HTTP2.set_window_size/3 for advertising a larger receive window to the server after a connection has been established.
• Add Mint.HTTP.request_body_window/2 for querying the available send-window when streaming a request body.
• Introduce the :optional_responses option for Mint.HTTP1.connect/4, with a :status_reason value that surfaces the HTTP/1.1 status reason-phrase as a new {:status_reason, request_ref, reason_phrase} response.
• Change t:Mint.HTTP.t/0 from an opaque to an open type.
• Add t:Mint.HTTPError.reason/0 and t:Mint.TransportError.reason/0.

Bug Fixes and Improvements

• Fix HTTP/1 handling of 1xx informational responses.
• Forbid or replace empty targets in HTTP/1.1 requests.

Commits

• f0b72c0 Release v1.9.3
• fc7d165 Merge commit from fork
• 5cbf7a3 Merge commit from fork
• d066c66 Fix Dialyzer
• 0622056 Release v1.9.2
• 566d702 Merge commit from fork
• 5779de1 Merge commit from fork
• bc63e9b Bump Elixir/Erlang versions in CI (#490)
• bc92a3a Fix Dialyzer
• f9a56d9 Release v1.9.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)