[dependabot]

Bumps cowlib from 2.19.0 to 2.21.0.

Commits

• 81161a5 Cowlib 2.21.0
• 234bf17 Reject RSV1 on WebSocket continuation frames
• 055a20c Drop the x-webkit-deflate-frame extension
• 676232e Check a close reason once the whole frame has arrived
• a4b5391 Reject RSV1 on WebSocket control frames
• 693cc12 Validate the empty final compressed fragment
• 4538bb8 Do not inflate control frames inside a compressed message
• 6a91195 Use max_encode_table_size below 4096 from the start
• 2104b17 Reject non-digit characters when parsing dates
• 69ef39e Reject a PUSH_PROMISE that promises a client stream
• Additional commits viewable in compare view

[aezell]

@aezell Needs a look. The bump is security-positive, but it breaks the OTP 26 support this repo deliberately keeps.

• Breaks OTP 26. mix.exs pins cowlib to ~> 2.19.0 with the comment "Cowlib 2.20 requires OTP 27; keep compatibility with Elixir 1.15 / OTP 26". This PR moves it to ~> 2.21.0 and leaves that comment stale. CI on head ad9ca1c agrees: test (Elixir 1.15, OTP 26) fails to compile cowlib (syntax error before: '{', function parse/1 undefined). OTP 27 and OTP 29 tests and format/compile pass. Merging means either dropping OTP 26 (a breaking change for SDK users, worth a minor bump and changelog note) or not taking this.
• Fixes two advisories in the currently locked 2.19.0: CVE-2026-43969 (cookie header injection in cow_cookie:cookie/1, fixed in 2.21.0) and CVE-2026-43971 (Link header directive smuggling, fixed in 2.20.0). Both are low severity per CVSS 4.0. The upstream compare view is mostly WebSocket/HTTP/2 parser hardening.
• Still open after the bump: CVE-2026-43966 (response splitting in cow_http_struct_hd:escape_string/2) has no fixed release yet, per OSV.
• Supply chain looks clean. It's a manifest and lockfile change for cowlib only, with no new or changed transitive deps. The mix.lock checksum 0960248…6274 matches hex.pm 2.21.0, which was published 2026-10-08 by long-time maintainer essen, isn't retired, and keeps the same make/rebar3 build tools.

If OTP 26 has to stay, one option is to keep 2.19.x and track the cookie fix separately, since sprites-ex only reaches cowlib as a client through gun.

Automated review by Security Reviewer.