Bump ash from 3.32.0 to 3.32.3

[dependabot]

Bumps ash from 3.32.0 to 3.32.3.

Release notes

Sourced from ash's releases.

v3.32.2

Bug Fixes:

• hold AsyncLimiter concurrency slot until the task completes by @​zachdaniel

• treat literal boolean/nil bounds in compare as values, not field names by @​zachdaniel

• enforce outer constraints and handle nil for nested arrays by @​zachdaniel (CVE-2026-82740)

• stream relationship flattening in runtime filters to bound memory by @​zachdaniel (CVE-2026-82742)

• block instead of busy-spinning while awaiting async reads by @​zachdaniel (CVE-2026-82743)

• authorize atomic update_many by merging the policy filter into each changeset by @​zachdaniel (CVE-2026-82746)

• forbid records whose policy scenarios are all impossible in runtime checks by @​zachdaniel (CVE-2026-82747)

• force the configured tag when dumping a map_with_tag union arm by @​zachdaniel (CVE-2026-82741)

• authorize aggregates under the same action they run under by @​zachdaniel (CVE-2026-82748)

• fail closed when a parent() relationship filter reference is unavailable by @​zachdaniel (CVE-2026-82749)

• reject duplicate primary keys on create in the ETS and Mnesia data layers by @​zachdaniel (CVE-2026-82745)

• fail closed when a reactor change step's where guard raises by @​zachdaniel (CVE-2026-82744)

• load stored non-v7 uuids leniently instead of erroring on read by @​zachdaniel (CVE-2026-82738)

• reject vectors exceeding the 65,535 dimension limit by @​zachdaniel (CVE-2026-82737)

• don't leak the stored field value in atomic confirm mismatch errors by @​zachdaniel (CVE-2026-82739)

• case-fold ci_string before validating length and match constraints by @​zachdaniel (CVE-2026-82736)

• skip string match regex once a length constraint is violated by @​zachdaniel (CVE-2026-82735)

• reject non-finite (Infinity/NaN) decimal values by @​zachdaniel (CVE-2026-82734)

• ensure private arguments survive atomic upgrade by @​zachdaniel

• require and apply tenant in atomic update_many by @​zachdaniel [(#2908)](ash-project/ash#2908)

• error on parent() relationship filters in manage_relationship lookups by @​zachdaniel [(#2908)](ash-project/ash#2908)

• validate and cap batch_size in Ash.stream! by @​zachdaniel [(#2908)](ash-project/ash#2908)

... (truncated)

Changelog

Sourced from ash's changelog.

v3.32.3 (2026-09-01)

Bug Fixes:

• include calculation arguments in manifest reachability by @​zachdaniel

v3.32.2 (2026-09-01)

Bug Fixes:

• hold AsyncLimiter concurrency slot until the task completes by @​zachdaniel

• treat literal boolean/nil bounds in compare as values, not field names by @​zachdaniel

• enforce outer constraints and handle nil for nested arrays by @​zachdaniel (CVE-2026-82740)

• stream relationship flattening in runtime filters to bound memory by @​zachdaniel (CVE-2026-82742)

• block instead of busy-spinning while awaiting async reads by @​zachdaniel (CVE-2026-82743)

• authorize atomic update_many by merging the policy filter into each changeset by @​zachdaniel (CVE-2026-82746)

• forbid records whose policy scenarios are all impossible in runtime checks by @​zachdaniel (CVE-2026-82747)

• force the configured tag when dumping a map_with_tag union arm by @​zachdaniel (CVE-2026-82741)

• authorize aggregates under the same action they run under by @​zachdaniel (CVE-2026-82748)

• fail closed when a parent() relationship filter reference is unavailable by @​zachdaniel (CVE-2026-82749)

• reject duplicate primary keys on create in the ETS and Mnesia data layers by @​zachdaniel (CVE-2026-82745)

• fail closed when a reactor change step's where guard raises by @​zachdaniel (CVE-2026-82744)

• load stored non-v7 uuids leniently instead of erroring on read by @​zachdaniel (CVE-2026-82738)

• reject vectors exceeding the 65,535 dimension limit by @​zachdaniel (CVE-2026-82737)

• don't leak the stored field value in atomic confirm mismatch errors by @​zachdaniel (CVE-2026-82739)

• case-fold ci_string before validating length and match constraints by @​zachdaniel (CVE-2026-82736)

• skip string match regex once a length constraint is violated by @​zachdaniel (CVE-2026-82735)

... (truncated)

Commits

• c935583 chore: release version v3.32.3
• 576a143 fix: include calculation arguments in manifest reachability
• c4505a4 chore: release version v3.32.2
• 66113a0 fix: hold AsyncLimiter concurrency slot until the task completes
• 65c7ee8 fix: treat literal boolean/nil bounds in compare as values, not field names
• c85ccff fix: enforce outer constraints and handle nil for nested arrays
• da07f00 fix: stream relationship flattening in runtime filters to bound memory
• 0a5ecd2 fix: block instead of busy-spinning while awaiting async reads
• ed4e656 fix: authorize atomic update_many by merging the policy filter into each chan...
• 6eddb8a fix: forbid records whose policy scenarios are all impossible in runtime checks
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)