Track dependency advisories: cowlib 2.18.0, earmark 1.4.49

[DROOdotFOO]

Summary

mix deps.get / hex.audit surfaces security advisories on two dependencies during CI (currently non-blocking in the Unified CI Pipeline). Dependabot is disabled on this repo, so these will not auto-surface via GitHub. Tracking them here.

Advisories

cowlib 2.18.0 (transitive)

• CVE-2026-43966 (MEDIUM) — HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2. https://osv.dev/vulnerability/EEF-CVE-2026-43966
• CVE-2026-43969 (LOW) — Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1. https://osv.dev/vulnerability/EEF-CVE-2026-43969

Provenance: transitive, plug_cowboy ~> 2.7 -> cowboy 2.17.0 -> cowlib >= 2.18.0 and < 3.0.0.

Exposure: low. Phoenix is a library-only dependency; there is no active web server in core (Ecto.Repo disabled at runtime, MCP served over stdio). The vulnerable code paths (HTTP header/cookie encoding) are only reachable if a cowboy-backed HTTP listener is actually served.

Fix path: bump cowlib to a patched release once cowboy publishes one compatible with the >= 2.18.0 and < 3.0.0 constraint (or bump cowboy). Re-run mix hex.audit to confirm resolution.

earmark 1.4.49 (near-top-level, optional)

• RETIRED — no longer maintained; upstream recommends migrating to MDEx.
• CVE-2026-48591 (MEDIUM) — Stored XSS via unescaped HTML attribute values in earmark. https://osv.dev/vulnerability/EEF-CVE-2026-48591

Provenance: declared earmark ~> 1.4, resolved from docs/markdown tooling. Loaded optionally via apply/3 (not a compile-time hard dep).

Exposure: low. Used for markdown-to-HTML rendering in doc/optional paths, not on any untrusted-input request path in core runtime.

Fix path: evaluate dropping earmark in favor of earmark_parser (already present, used by ex_doc) or migrating to MDEx. Confirm no runtime code relies on Earmark.as_html/* before removing.

Suggested actions

• Bump/patch cowlib (via cowboy) once a fixed release is available
• Migrate off retired earmark (MDEx or earmark_parser)
• Consider enabling Dependabot / GitHub security advisories on the repo so these surface automatically
• Keep the CI security scan non-blocking until fixes land

Notes

Neither advisory affects the core terminal/agent/payments runtime hot paths. Priority: low-to-medium, pre-launch hardening.

[DROOdotFOO]

Status update (re-audited the current tree)

Re-ran mix hex.audit against the live lockfile; the picture shifted since this
was filed:

earmark -- RESOLVED (no action needed)

There is no earmark dependency anywhere (root or packages) -- only
earmark_parser 1.4.44, a different, maintained package with no advisory. The
one usage site (markdown_renderer.ex) calls EarmarkParser.as_ast to build
terminal elements, not Earmark.as_html, so there's no HTML/XSS surface.
hex.audit no longer flags earmark.

tesla -- RESOLVED in #415

Not in this issue's original list, but the audit surfaced tesla 1.15.3 with
five advisories (three HIGH: auth-header leak on redirect, atom-table
exhaustion, decompression bomb). It was an orphaned lock entry: oauth2 was
removed from mix.exs ("# Removed - unused") but its lock record and transitive
tesla stayed behind. #415 ran mix deps.unlock --unused (18 orphaned entries
pruned, removals-only) -- all tesla advisories are gone. Tesla wasn't used at
runtime anyway (project uses Req).

cowlib 2.18.0 -- STILL OPEN (upstream-blocked)

2.18.0 is the latest cowlib release, and cowboy 2.17.0 the latest cowboy
-- there is no patched version to bump to. It remains a real transitive dep
(plug_cowboy -> cowboy -> cowlib >= 2.18.0 and < 3.0.0). Exposure stays low
(Phoenix is library-only; no active cowboy HTTP listener in core; MCP over stdio).

Keeping this issue open to track cowlib only. Re-run mix hex.audit when
ninenines publishes a fixed cowlib (or a cowboy that requires one) and bump then.
The other two suggested actions -- enable Dependabot, keep the CI scan
non-blocking -- are unchanged.