mwoods79 · Nov 7, 2026 · Nov 2, 2026 · Nov 2, 2026 · Nov 2, 2026 · Nov 2, 2026
diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
@@ -19,7 +19,7 @@ jobs:
       - uses: erlef/setup-beam@v1.24.1
         with:
           otp-version: '29.1.2'
-          elixir-version: '1.20.4'
+          elixir-version: '1.20.5'
       # Hex 2.5 includes security advisories in hex.audit.
       - name: Install Hex with security advisory support
         run: mix local.hex 2.6.0 --force

diff --git a/.github/workflows/elixir.yml b/.github/workflows/elixir.yml
@@ -42,7 +42,7 @@ jobs:
       # and running the workflow steps.
       matrix:
         otp: ['29.1.2']       # Define the OTP version [required]
-        elixir: ['1.20.4']    # Define the elixir version [required]
+        elixir: ['1.20.5']    # Define the elixir version [required]
     steps:
     # Step: Setup Elixir + Erlang image as the base.
     - name: Set up Elixir
@@ -149,7 +149,7 @@ jobs:
     strategy:
       matrix:
         otp: ['29.1.2']
-        elixir: ['1.20.4']
+        elixir: ['1.20.5']
     steps:
     - name: Set up Elixir
       uses: erlef/setup-beam@v1.24.1
@@ -212,7 +212,7 @@ jobs:
     - uses: erlef/setup-beam@v1.24.1
       with:
         otp-version: '29.1.2'
-        elixir-version: '1.20.4'
+        elixir-version: '1.20.5'
     - uses: actions/setup-node@v7.1.0
       with:
         node-version: '24'

diff --git a/.mise.toml b/.mise.toml
@@ -1,5 +1,5 @@
 [tools]
-elixir = "1.20.4-otp-29"
+elixir = "1.20.5-otp-29"
 erlang = "29.1.2"
 
 [tasks.sync-rules]

diff --git a/Dockerfile b/Dockerfile
@@ -9,11 +9,11 @@
 #   - https://hub.docker.com/r/hexpm/elixir/tags - for the build image
 #   - https://hub.docker.com/_/debian/tags?name=trixie-slim - for the release image
 #   - https://pkgs.org/ - resource for finding needed packages
-#   - Ex: docker.io/hexpm/elixir:1.20.4-erlang-29.1.2-debian-trixie-20261020-slim
+#   - Ex: docker.io/hexpm/elixir:1.20.5-erlang-29.1.2-debian-trixie-20261027-slim
 #
-ARG ELIXIR_VERSION=1.20.4
+ARG ELIXIR_VERSION=1.20.5
 ARG OTP_VERSION=29.1.2
-ARG DEBIAN_VERSION=trixie-20261020-slim
+ARG DEBIAN_VERSION=trixie-20261027-slim
 
 ARG BUILDER_IMAGE="docker.io/hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION}-debian-${DEBIAN_VERSION}"
 ARG RUNNER_IMAGE="docker.io/debian:${DEBIAN_VERSION}"

diff --git a/mix.exs b/mix.exs
@@ -23,7 +23,11 @@ defmodule Huddlz.MixProject do
           ~r/features\/support/,
           ~r/browser\/(steps|support)/
         ] ++ if(browser_tests?, do: [], else: [~r/browser/]),
-      usage_rules: usage_rules()
+      usage_rules: usage_rules(),
+      # assent's fix (0.3.2) needs ash_authentication 5.x. The advisory covers the
+      # Sign in with Apple callback; we only use the password strategy. Remove this
+      # when moving to ash_authentication 5.x.
+      hex: [ignore_advisories: ["EEF-CVE-2026-117656"]]
     ]
   end
 

diff --git a/mix.lock b/mix.lock
diff --git a/test/features/step_definitions/location_based_time_zones_steps.exs b/test/features/step_definitions/location_based_time_zones_steps.exs
@@ -777,7 +777,12 @@ defmodule LocationBasedTimeZonesSteps do
   end
 
   step "the search should still use {string}", %{args: [time_zone]} = context do
-    PhoenixTest.assert_path(context.session, "/discover", query: %{"time_zone" => time_zone})
+    PhoenixTest.assert_path(context.session, "/discover")
+
+    query =
+      context.session.current_path |> URI.parse() |> Map.fetch!(:query) |> URI.decode_query()
+
+    assert query["time_zone"] == time_zone
     context
   end
 

diff --git a/test/features/user_profile.feature b/test/features/user_profile.feature
@@ -54,6 +54,7 @@ Feature: User Profile Management
   @email_change_pending
   Scenario: Requesting a sign-in email change keeps the current address active
     Given the user "alice+user-profile@example.com" has password "OldPassword123!"
+    And I am signed in as "alice+user-profile@example.com"
     And I am on my profile page
     When I fill in "New email" with "alice.changed@example.com"
     And I fill in "Confirm current password" with "OldPassword123!"
@@ -65,6 +66,7 @@ Feature: User Profile Management
 
   Scenario: Rejecting an invalid sign-in email
     Given the user "alice+user-profile@example.com" has password "OldPassword123!"
+    And I am signed in as "alice+user-profile@example.com"
     And I am on my profile page
     When I fill in "New email" with "not-an-email"
     And I fill in "Confirm current password" with "OldPassword123!"
@@ -74,6 +76,7 @@ Feature: User Profile Management
 
   Scenario: Rejecting a sign-in email change with the wrong password
     Given the user "alice+user-profile@example.com" has password "OldPassword123!"
+    And I am signed in as "alice+user-profile@example.com"
     And I am on my profile page
     When I fill in "New email" with "alice.changed@example.com"
     And I fill in "Confirm current password" with "WrongPassword"
@@ -83,6 +86,7 @@ Feature: User Profile Management
 
   Scenario: Rejecting a sign-in email already used by another person
     Given the user "alice+user-profile@example.com" has password "OldPassword123!"
+    And I am signed in as "alice+user-profile@example.com"
     And the following users exist:
       | email                          | role | display_name |
       | taken+user-profile@example.com | user | Taken Email  |