Bump the non-breaking-changes group across 1 directory with 3 updates

[dependabot]

Bumps the non-breaking-changes group with 3 updates in the / directory: exla, hackney and tesla.

Updates exla from 0.12.0 to 0.13.0

Release notes

Sourced from exla's releases.

v0.13.0 - 2026-07-17

What's Changed

Humanized changelog visible in the individual libraries

• fix: raise better message when calling grad with closures by @​polvalente in elixir-nx/nx#1757
• Support vectorized gradients via boundary devectorization (#1533) by @​blasphemetheus in elixir-nx/nx#1731
• Add more padding variations: cycle, replicate and mirror by @​laszlokorte in elixir-nx/nx#1719
• fix: remove on_load ordering by @​polvalente in elixir-nx/nx#1763
• better description of padding parameters by @​karlosmid in elixir-nx/nx#1768
• Implement EXLA hooks via host callback without outfeed by @​Chapaman in elixir-nx/nx#1766
• fix: mitigate false positives on recompilation check by @​polvalente in elixir-nx/nx#1764
• ci: run formatter and default CI on Elixir 1.20 with OTP 28 by @​polvalente in elixir-nx/nx#1772
• fix: Nx.Defn.Graph should keep nested scopes hermetic by @​polvalente in elixir-nx/nx#1771
• fix: do not hoist non-expr tensor arguments by @​polvalente in elixir-nx/nx#1773
• Remove token plumbing from Nx hooks by @​Chapaman in elixir-nx/nx#1767
• Add :pjrt_plugin platform for loading external PJRT plugins by @​chapai in elixir-nx/nx#1777
• fix: batched gradients for lu, invert, triangular_solve and determinant by @​RicardoSantos-99 in elixir-nx/nx#1778
• Standardize docs across nx, exla, torchx by @​Chapaman in elixir-nx/nx#1770
• Fix Nx.clip gradient applying upstream grad twice (g²) by @​blasphemetheus in elixir-nx/nx#1779
• Fix vectorized grad/2 for ops that cross the devectorization boundary by @​Chapaman in elixir-nx/nx#1775

New Contributors

• @​laszlokorte made their first contribution in elixir-nx/nx#1719
• @​karlosmid made their first contribution in elixir-nx/nx#1768
• @​chapai made their first contribution in elixir-nx/nx#1777
• @​RicardoSantos-99 made their first contribution in elixir-nx/nx#1778

Full Changelog: elixir-nx/nx@v0.12.1...v0.13.0

v0.12.1 - 2026-05-22

What's Changed

• refactor: better memory footprint for thin svd by @​polvalente in elixir-nx/nx#1753

Full Changelog: elixir-nx/nx@v0.12.0...v0.12.1

Commits

• 770993a chore: update to 0.13
• 7ba1d5e Fix vectorized grad/2 for ops that cross the devectorization boundary (#1775)
• 0455323 Fix Nx.clip gradient applying upstream grad twice (g²) (#1779)
• c7b084d Standardize docs across nx, exla, torchx (#1770)
• 33c2597 fix: batched gradients for lu, invert, triangular_solve and determinant (#1778)
• 798fafb Add :pjrt_plugin platform for loading external PJRT plugins (#1777)
• fcfc1e3 Remove token plumbing from Nx hooks (#1767)
• da2c15c fix: do not hoist non-expr tensor arguments (#1773)
• bd74eac fix: Nx.Defn.Graph should keep nested scopes hermetic (#1771)
• 5d4eb32 ci: run formatter and default CI on Elixir 1.20 with OTP 28 (#1772)
• Additional commits viewable in compare view

Updates hackney from 4.6.0 to 4.7.2

Release notes

Sourced from hackney's releases.

4.7.2

Bump quic to 1.7.1. A clean QUIC connection close (idle pooled HTTP/3 connections, orderly shutdown) no longer emits ERROR and CRASH reports from quic_h3_connection nor propagates an abnormal exit to the connection owner. This also removes the intermittent eunit group cancellation in the h3/wt test suites.

See NEWS.md for details. PR #913.

4.7.1

Chunked decoding no longer fails with {error, invalid_chunk_size} when the CRLF terminating a chunk-size line is split across two socket reads (buffer ending on a lone \r). The parser now waits for the \n (#901).

A malformed chunk-size line or chunk terminator now fails cleanly with {error, invalid_chunk_size} or {error, poorly_formatted_chunked_size} instead of crashing the parser with a case_clause error.

See NEWS.md for details. PR #912.

4.7.0

HTTP/2 request bodies larger than the peer's flow control window no longer fail with {error, send_buffer_full}. Body sends block until the server opens the window, bounded by the new send_timeout option (default 30000 ms, infinity allowed, nonblock restores the old fail-fast behavior). If the window never opens the request fails with {error, timeout} and the abandoned stream is reset so its buffered body does not linger on a shared connection. Applies to whole-body and streamed HTTP/2 request bodies; HTTP/1.1 and HTTP/3 are unchanged.

HTTP/2 async requests now deliver their response messages: the stream entry stored an internal reference where the delivery code expected the stream_to pid, so every async HTTP/2 response was silently dropped.

HTTP/2 {async, once} now honors stream_next/1 with the same contract as HTTP/1.1: status and headers eagerly, then one message per pull. once streams use h2 manual flow control, so a slow consumer keeps the peer's window closed and in-flight data stays bounded to one window.

Connections created with hackney:connect/4 and {pool, false} honor a {send_timeout, T} connect option; pooled connections keep the default and take the per-request option instead.

See NEWS.md for details. PR #911.

4.6.1

Changed

• Bump h2 to 0.11.0. It adds h2:peername/1, which returns the peer's {IpAddress, Port} for a live connection. Additive only; no behavior change for hackney.

Changelog

Sourced from hackney's changelog.

4.7.2 - 2026-07-17

Changed

• Bump quic to 1.7.1. A clean QUIC connection close (idle pooled HTTP/3 connections, orderly shutdown) no longer emits ERROR and CRASH reports from quic_h3_connection nor propagates an abnormal exit to the connection owner. This also removes the intermittent eunit group cancellation in the h3/wt test suites.

4.7.1 - 2026-07-17

Fixed

• Chunked decoding no longer fails with {error, invalid_chunk_size} when the CRLF terminating a chunk-size line is split across two socket reads (buffer ending on a lone \r). The parser now waits for the \n (#901).
• A malformed chunk-size line or chunk terminator now fails cleanly with {error, invalid_chunk_size} or {error, poorly_formatted_chunked_size} instead of crashing the parser with a case_clause error.

4.7.0 - 2026-07-17

Fixed

• HTTP/2 request bodies larger than the peer's flow control window no longer fail with {error, send_buffer_full}. Body sends now block until the server opens the window with WINDOW_UPDATE frames, bounded by the new send_timeout request option (default 30000 ms, infinity allowed). If the window never opens the request fails with {error, timeout} instead of hanging, and the abandoned stream is reset (RST_STREAM) so its buffered body does not linger on a shared connection. Pass {send_timeout, nonblock} to restore the previous non-blocking behavior. Applies to whole-body and streamed HTTP/2 request bodies; HTTP/1.1 and HTTP/3 are unchanged.
• HTTP/2 async requests now deliver their response messages. The stream entry stored the internal call reference where the delivery code expected the stream_to pid, so every async HTTP/2 response was silently dropped and the caller never received {hackney_response, Ref, ...} messages.
• HTTP/2 {async, once} now honors stream_next/1 with the same contract as HTTP/1.1: status and headers are delivered eagerly, then each stream_next/1 delivers exactly one message (a body chunk or done). Previously every frame was pushed eagerly, identical to {async, true}. once-mode streams run h2 manual flow control, so a slow consumer keeps the peer's window closed and in-flight data stays bounded to one window.
• Connections created with hackney:connect/4 and {pool, false} honor a {send_timeout, T} connect option again (hackney:send_request/2 has no per-request options channel). Pooled connections keep the constant default

... (truncated)

Commits

• 9d684fb Release 4.7.2
• ed264d5 Merge pull request #913 from benoitc/bump/quic-1.7.1
• 3ba2d56 Bump quic to 1.7.1
• 447d868 Release 4.7.1
• 87a75e8 Merge pull request #912 from benoitc/fix/chunk-size-split-crlf
• 6a5db75 Wait for the LF when a chunk-size line splits on the CR
• 1c34f0b Release 4.7.0
• f62ce83 Merge pull request #911 from benoitc/fix/h2-blocking-send-flow-control
• 3818b68 Route raw-server test notifications through a collector
• 4589443 Fix review findings: h2 async once, manual send_timeout, dialyzer
• Additional commits viewable in compare view

Updates tesla from 1.20.0 to 1.21.0

Release notes

Sourced from tesla's releases.

v1.21.0

1.21.0 (2026-08-01)

Features

• add support for the HTTP QUERY method (RFC 10008) (#896) (c3b7bf5)

Bug Fixes

• ci: bump release workflow to OTP 28.5 (#888) (aa22331)
• ci: bump test matrix to OTP 28.5 (#899) (279f8bc)
• handle atom header keys in FollowRedirects header filtering (#898) (a3d6c94)
• silence compiler warnings on Elixir 1.20.1 (#892) (863d836)

Changelog

Sourced from tesla's changelog.

1.21.0 (2026-08-01)

Features

• add support for the HTTP QUERY method (RFC 10008) (#896) (c3b7bf5)

Bug Fixes

• ci: bump release workflow to OTP 28.5 (#888) (aa22331)
• ci: bump test matrix to OTP 28.5 (#899) (279f8bc)
• handle atom header keys in FollowRedirects header filtering (#898) (a3d6c94)
• silence compiler warnings on Elixir 1.20.1 (#892) (863d836)

Commits

• cc68e05 chore(master): release 1.21.0 (#889)
• d414d84 chore(deps-dev): bump the dev group with 2 updates (#903)
• 43cabea chore: fix typos in Compression middleware comments (#901)
• dc56717 chore(deps): bump actions/cache from 5 to 6 (#894)
• 6ac6f32 chore(deps): bump actions/checkout from 6 to 7 (#893)
• 53f58e6 chore(deps-dev): bump the dev group across 1 directory with 4 updates (#900)
• 279f8bc fix(ci): bump test matrix to OTP 28.5 (#899)
• a3d6c94 fix: handle atom header keys in FollowRedirects header filtering (#898)
• c3b7bf5 feat: add support for the HTTP QUERY method (RFC 10008) (#896)
• 863d836 fix: silence compiler warnings on Elixir 1.20.1 (#892)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions