Bump ex_doc from 0.40.3 to 0.40.4 in the non-security group

[dependabot]

Bumps the non-security group with 1 update: ex_doc.

Updates ex_doc from 0.40.3 to 0.40.4

Changelog

Sourced from ex_doc's changelog.

v0.40.4 (2026-09-03)

• Enhancements

  • Add :api_reference_noindex option to keep search engines from indexing api-reference.html
  • Generate reproducible HTML and EPUB output
  • Link HexDocs packages through their per-package subdomains

• Bug fixes

  • Preserve in-page anchors during Swup navigation and fully reload navigation between ExDoc builds
  • Format Elixir specs consistently regardless of their source line numbers
  • Autolink the Erlang/OTP 29 built-in record/0 type
  • Fix focus outline positioning for top-content heading action icons

Commits

• 80270f3 Release v0.40.4
• 934cf54 Reference to missing section (#2264)
• b5679af Add license information for remixicon font (#2263)
• 850f709 Bump brace-expansion from 1.1.12 to 1.1.18 in /assets (#2261)
• 873e03e Bump postcss from 8.5.15 to 8.5.26 in /assets (#2259)
• 27660d3 Bump js-yaml from 4.2.0 to 4.3.1 in /assets (#2260)
• ffec214 Bump postcss from 8.5.6 to 8.5.15 in /assets (#2241)
• 23cbd23 epub: Honor SOURCE_DATE_EPOCH for dcterms:modified and dc:identifier (#2256)
• a37128a Use a fixed makeup group_prefix for reproducible HTML output (#2255)
• 01f4763 Update earmark_parser dependency version -> 1.4.46 (#2254)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[broly-code-security-scanner]

Broly Security Scan

Warning

Latest baseline snapshot is stale. Broly is running in PR-only fallback mode until the next scheduled baseline refreshes. This does not block the PR.

Warning

⚠️ Potential results — Broly is still completing analysis or verification. This comment will update automatically.
Files pending AI analysis: 0; findings pending verification: 3.

Note

Summary

3 actionable finding(s) in this PR

• 🟡 3 medium

All actionable items are in the table below.

No finding is at or above high, so this check is not blocking. The findings above are still tracked and reported.

Severity	Scanner	Issue	Location	Dismiss
🟡 MEDIUM	SCA	mint@1.8.0 — 13 vulnerabilities (worst: EEF-CVE-2026-48861) → >= 1.9.3	mix.lock:1	d2
🟡 MEDIUM	SCA	req@0.5.18 — 4 vulnerabilities (worst: EEF-CVE-2026-49755) → >= 0.6.1	mix.lock:1	d3
🟡 MEDIUM	SCA	EEF-CVE-2026-58226: hpax@1.0.3 → >= 1.0.4	mix.lock:1	d1

Dismiss false positives

Tick a box to dismiss the finding; untick it to bring the finding back. That is the same as replying /broly dismiss d1 and /broly undismiss d1. To record why it is a false positive, reply with /broly dismiss d1: your reason instead — Broly reuses those reasons to triage similar findings across the org.

• d1 · 🟡 MEDIUM   · mix.lock:1 · EEF-CVE-2026-58226: hpax@1.0.3
• d2 · 🟡 MEDIUM   · mix.lock:1 · mint@1.8.0 — 13 vulnerabilities (worst: EEF-CVE-2026-48861)
• d3 · 🟡 MEDIUM   · mix.lock:1 · req@0.5.18 — 4 vulnerabilities (worst: EEF-CVE-2026-49755)

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (zai-org/GLM-5.3-Flash) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Exploit Chains · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.