chore(deps): clear hex.audit advisories in the dev/test lockfile · NarrativeApp/jsonapi@dd5b0af · GitHub
Skip to content

Commit dd5b0af

Browse files
puzza007claude
andcommitted
chore(deps): clear hex.audit advisories in the dev/test lockfile
`mix hex.audit` (the CI `audit` job, which `is_releasable` depends on) has not run against master since 2025-01 and now fails on advisories published since. None of the flagged packages are runtime deps of a consumer — plug is a library requirement (`~> 1.10`, unchanged) that the consuming app pins itself, and phoenix/earmark are dev/test only — so this only touches the lockfile: - plug 1.16.1 -> 1.17.4 (EEF-CVE-2026-54892, -8468, -56814, -56813) Kept on the 1.17 line: plug 1.19+ needs Elixir >= 1.15 and CI runs 1.14 (1.20.3 fails to compile there). Same line CoreGateway runs. - phoenix 1.7.18 -> 1.7.24 (EEF-CVE-2026-32689, -56811, -56812) - earmark removed. It was an orphan `only: :dev` dep: nothing in lib/ or mix.exs references Earmark, and ex_doc uses earmark_parser. It is retired upstream and carries EEF-CVE-2026-48591. `mix hex.audit`: "No retired or security advisory packages found", so no allowlist is needed. Tests, credo and the formatter are unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 parent b5971b4 commit dd5b0af

2 files changed

Lines changed: 8 additions & 10 deletions

File tree

‎mix.exs‎

Lines changed: 0 additions & 1 deletion

‎mix.lock‎

Lines changed: 8 additions & 9 deletions

0 commit comments

Comments
 (0)