Bump ecto from 3.14.1 to 3.14.2 in the non-security group

[dependabot]

Bumps the non-security group with 1 update: ecto.

Updates ecto from 3.14.1 to 3.14.2

Changelog

Sourced from ecto's changelog.

v3.14.2 (2026-08-14)

Enhancements

• [Ecto.Schema] Allow configuring :writable and :on_writable_violation for the :inserted_at field generated by timestamps/1

Bug fixes

• [Ecto.Changeset] Fix changed?/3 for removed one-to-one relations
• [Ecto.Changeset] Fix stale belongs_to keys in apply_changes/1
• [Ecto.Changeset] Preserve prepare_changes callbacks in merge/2
• [Ecto.Changeset] Preserve the default :on_cast function in relation type metadata
• [Ecto.Query] Fix source field caching for map updates
• [Ecto.Repo] Propagate the caller's Logger level to preload tasks
• [Ecto.Repo] Enforce writable fields after prepare_changes callbacks
• [Ecto.Schema] Fix autogeneration options for composite types
• [Ecto.Schema] Avoid compile-time dependencies on modules named in @derive
• [Ecto.Type] Normalize DateTime casts to UTC

Commits

• f6eb492 Release v3.14.2
• f13d064 Make sure on_cast information is available on type metadata
• 80f82a9 Allow for specifying :writable and :on_writable_violation options for :insert...
• 7b36fe6 Avoid compile-time dependency on modules named in derive (#4779)
• 4e704f2 Normalize DateTime casts to UTC (#4775)
• fa6dd6a Fix autogenerate options for composite types (#4773)
• 2e2af81 Enforce writable fields after prepare_changes (#4771)
• 8f97303 Fix link formatting for supervision tree reference
• abeab7a Propagate the caller's Logger level to preload tasks (#4766)
• bac6db2 Preserve prepare_changes in Ecto.Changeset.merge/2 (#4768)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[broly-code-security-scanner]

Broly Security Scan

Note

✅ Clean scan
No vulnerabilities detected in this PR.

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (zai-org/GLM-5.2) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Exploit Chains · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.