Repository navigation
Conversation
Member
Author
|
Sadly, I have higher priority tasks that I need to be focussed on than this right now ... 🙃 |
Phoenix v.1.8.5 #330Phoenix v.1.8.8 #330
Member
Author
Phoenix v.1.8.8 #330Phoenix v.1.8.9 #330
Member
Author
|
Will pick this up on my laptop 💻 as soon as my other work is done. 🤞 |
Member
Author
Member
Author
|
Just pulled this down to try and continue. mix deps.getGot: Found packages with security advisories, see above for detailslazy_html 0.1.12 VULNERABLE!
EEF-CVE-2026-92106 (LOW)
aka: CVE-2026-92106, GHSA-8rqp-v692-v82q
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
https://osv.dev/vulnerability/EEF-CVE-2026-92106
phoenix_html 4.3.0 VULNERABLE!
EEF-CVE-2026-117645 (MEDIUM)
aka: CVE-2026-117645
Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
https://osv.dev/vulnerability/EEF-CVE-2026-117645
plug_crypto 2.2.0 VULNERABLE!
EEF-CVE-2026-105963 (MEDIUM)
aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
https://osv.dev/vulnerability/EEF-CVE-2026-105963
ssl_verify_fun 1.1.7 VULNERABLE!
EEF-CVE-2026-117666 (CRITICAL)
aka: CVE-2026-117666, GHSA-7gw2-hphm-c5px
ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
https://osv.dev/vulnerability/EEF-CVE-2026-117666
...Not Ran: mix hex.auditFound packages with security advisories, see above for details
You have added/upgraded packages you could sponsor, run `mix hex.sponsor` to learn more
a@mbp16 phoenix-chat-example % mix hex.audit
Advisories:
ecto 3.14.2 - EEF-CVE-2026-118391 (HIGH)
aka: CVE-2026-118391, GHSA-cxjx-vmm2-qr8r
Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto
https://osv.dev/vulnerability/EEF-CVE-2026-118391
plug_crypto 2.2.0 - EEF-CVE-2026-105963 (MEDIUM)
aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
https://osv.dev/vulnerability/EEF-CVE-2026-105963
hackney 4.7.4 - EEF-CVE-2026-112880 (LOW)
aka: CVE-2026-112880
CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
https://osv.dev/vulnerability/EEF-CVE-2026-112880
hackney 4.7.4 - EEF-CVE-2026-97200 (HIGH)
aka: CVE-2026-97200
Unbounded response body buffering and decompression in hackney
https://osv.dev/vulnerability/EEF-CVE-2026-97200
hackney 4.7.4 - EEF-CVE-2026-115700 (MEDIUM)
aka: CVE-2026-115700
SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
https://osv.dev/vulnerability/EEF-CVE-2026-115700
hackney 4.7.4 - EEF-CVE-2026-115693 (CRITICAL)
aka: CVE-2026-115693
Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
https://osv.dev/vulnerability/EEF-CVE-2026-115693
hackney 4.7.4 - EEF-CVE-2026-113440 (MEDIUM)
aka: CVE-2026-113440
HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
https://osv.dev/vulnerability/EEF-CVE-2026-113440
jose 1.11.12 - EEF-CVE-2026-65625 (MEDIUM)
aka: CVE-2026-65625, GHSA-6gxw-6f7r-cjr6
Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose
https://osv.dev/vulnerability/EEF-CVE-2026-65625
jose 1.11.12 - EEF-CVE-2026-65626 (MEDIUM)
aka: CVE-2026-65626, GHSA-vwvr-f994-6j9j
Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose
https://osv.dev/vulnerability/EEF-CVE-2026-65626
jose 1.11.12 - EEF-CVE-2026-65627 (MEDIUM)
aka: CVE-2026-65627, GHSA-wfpv-qxp8-x5gm
Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2
https://osv.dev/vulnerability/EEF-CVE-2026-65627
jose 1.11.12 - EEF-CVE-2026-65628 (MEDIUM)
aka: CVE-2026-65628, GHSA-fpj2-9h59-32pp
Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types
https://osv.dev/vulnerability/EEF-CVE-2026-65628
jose 1.11.12 - EEF-CVE-2026-65629 (HIGH)
aka: CVE-2026-65629, GHSA-h4gx-8jq2-mfhc
Weak PBKDF2 parameters for password-encrypted private-key export in jose
https://osv.dev/vulnerability/EEF-CVE-2026-65629
jose 1.11.12 - EEF-CVE-2026-65630 (MEDIUM)
aka: CVE-2026-65630, GHSA-xvr2-gggj-h2pp
Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose
https://osv.dev/vulnerability/EEF-CVE-2026-65630
jose 1.11.12 - EEF-CVE-2026-65631 (MEDIUM)
aka: CVE-2026-65631, GHSA-3m45-vrpj-xmrq
erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service
https://osv.dev/vulnerability/EEF-CVE-2026-65631
jose 1.11.12 - EEF-CVE-2026-65632 (MEDIUM)
aka: CVE-2026-65632, GHSA-44hw-rpw9-mwg4
ECDSA signature length is not validated in jose, allowing signature malleability
https://osv.dev/vulnerability/EEF-CVE-2026-65632
phoenix_html 4.3.0 - EEF-CVE-2026-117645 (MEDIUM)
aka: CVE-2026-117645
Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
https://osv.dev/vulnerability/EEF-CVE-2026-117645
bandit 1.12.5 - EEF-CVE-2026-114216 (MEDIUM)
aka: CVE-2026-114216, GHSA-w5wc-g2hc-g7m2
Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-114216
bandit 1.12.5 - EEF-CVE-2026-108525 (HIGH)
aka: CVE-2026-108525, GHSA-c3g7-2pg5-qvwh
HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-108525
bandit 1.12.5 - EEF-CVE-2026-105659 (HIGH)
aka: CVE-2026-105659, GHSA-69m6-wcv4-rwcf
HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-105659
bandit 1.12.5 - EEF-CVE-2026-105660 (MEDIUM)
aka: CVE-2026-105660, GHSA-v53v-9hvg-37jf
Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-105660
bandit 1.12.5 - EEF-CVE-2026-116078 (HIGH)
aka: CVE-2026-116078, GHSA-pxjf-g536-7r93
HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-116078
bandit 1.12.5 - EEF-CVE-2026-109584 (HIGH)
aka: CVE-2026-109584, GHSA-7gfj-7gvq-3xqj
HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-109584
bandit 1.12.5 - EEF-CVE-2026-108529 (HIGH)
aka: CVE-2026-108529, GHSA-j363-h72p-296m
SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-108529
bandit 1.12.5 - EEF-CVE-2026-110314 (MEDIUM)
aka: CVE-2026-110314, GHSA-2v5v-8f9v-xh85
WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-110314
bandit 1.12.5 - EEF-CVE-2026-110499 (HIGH)
aka: CVE-2026-110499, GHSA-47x4-3fxf-82fr
Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-110499
bandit 1.12.5 - EEF-CVE-2026-111101 (HIGH)
aka: CVE-2026-111101, GHSA-jwh3-j29h-qfmw
HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-111101
bandit 1.12.5 - EEF-CVE-2026-111103 (HIGH)
aka: CVE-2026-111103, GHSA-2238-pgfc-w82m
HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-111103
bandit 1.12.5 - EEF-CVE-2026-113436 (HIGH)
aka: CVE-2026-113436, GHSA-29cr-8477-rg6r
Quadratic bignum parsing of Content-Length and Host port values in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-113436
bandit 1.12.5 - EEF-CVE-2026-114213 (HIGH)
aka: CVE-2026-114213, GHSA-cpx7-qf6w-jc63
WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-114213
bandit 1.12.5 - EEF-CVE-2026-115269 (HIGH)
aka: CVE-2026-115269, GHSA-p2qv-vx88-385x
HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
https://osv.dev/vulnerability/EEF-CVE-2026-115269
lazy_html 0.1.12 - EEF-CVE-2026-92106 (LOW)
aka: CVE-2026-92106, GHSA-8rqp-v692-v82q
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
https://osv.dev/vulnerability/EEF-CVE-2026-92106
ssl_verify_fun 1.1.7 - EEF-CVE-2026-117666 (CRITICAL)
aka: CVE-2026-117666, GHSA-7gw2-hphm-c5px
ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
https://osv.dev/vulnerability/EEF-CVE-2026-117666
decimal 3.1.1 - EEF-CVE-2026-97853 (MEDIUM)
aka: CVE-2026-97853, GHSA-6c27-994x-c52f
Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS
https://osv.dev/vulnerability/EEF-CVE-2026-97853
Found packages with security advisoriesThis is a lot of advisories for a "stock" mix deps.update --allRef: https://hexdocs.pm/mix/Mix.Tasks.Deps.Update.html |
1 task
Member
Author
mix c
Running ExUnit with seed: 170685, max_cases: 20
.....
Finished in 0.07 seconds (0.01s async, 0.06s sync)
Result: 5 passed
----------------
COV FILE LINES RELEVANT MISSED
0.0% lib/chat.ex 9 0 0
0.0% lib/chat/repo.ex 5 0 0
71.4% lib/chat_web/components/layouts.ex 160 21 6
100.0% lib/chat_web/controllers/error_html.ex 24 1 0
100.0% lib/chat_web/controllers/error_json.ex 21 1 0
100.0% lib/chat_web/controllers/page_controller 7 1 0
0.0% lib/chat_web/controllers/page_html.ex 10 0 0
0.0% lib/chat_web/endpoint.ex 51 0 0
100.0% lib/chat_web/router.ex 23 2 0
[TOTAL] 76.9%
----------------
Generating report...
Saved to: cover/
FAILED: Expected minimum coverage of 100%, got 76.9%.The offending file is: |
Member
Author
Error: ENOENT: no such file or directory, scandir '/phoenix-chat-example/deps/heroicons/optimized/24/outline'
** (Mix) `mix tailwind chat` exited with 1Error: ENOENT: no such file or directory, scandir deps/heroicons/optimized/24/outline Read phoenixframework/tailwind#119 but sadly not helpful. 🙃 |
Member
Author
|
Ran: mix phx.serverSee the following in terminal: [info] GET /assets/css/app.css
[debug] ** (Phoenix.Router.NoRouteError) no route found for GET /assets/css/app.css (ChatWeb.Router)
(chat 1.8.16) deps/phoenix/lib/phoenix/router.ex:477: ChatWeb.Router.call/2
(chat 1.8.16) lib/chat_web/endpoint.ex:1: ChatWeb.Endpoint.plug_builder_call/2
(chat 1.8.16) deps/plug/lib/plug/debugger.ex:155: ChatWeb.Endpoint."call (overridable 3)"/2
(chat 1.8.16) lib/chat_web/endpoint.ex:1: ChatWeb.Endpoint.call/2
(phoenix 1.8.16) lib/phoenix/endpoint/sync_code_reload_plug.ex:22: Phoenix.Endpoint.SyncCodeReloadPlug.do_call/4
(bandit 1.14.1) lib/bandit/pipeline.ex:168: Bandit.Pipeline.call_plug!/2
(bandit 1.14.1) lib/bandit/pipeline.ex:44: Bandit.Pipeline.run/5
(bandit 1.14.1) lib/bandit/http1/handler.ex:23: Bandit.HTTP1.Handler.handle_data/3
(bandit 1.14.1) lib/bandit/delegating_handler.ex:18: Bandit.DelegatingHandler.handle_data/3
(thousand_island 1.6.0) lib/thousand_island/handler.ex:636: ThousandIsland.Handler.invoke_callback/2
(bandit 1.14.1) lib/bandit/delegating_handler.ex:8: Bandit.DelegatingHandler.handle_info/2
(stdlib 8.1.1) gen_server.erl:2434: :gen_server.try_handle_info/3
(stdlib 8.1.1) gen_server.erl:2420: :gen_server.handle_msg/3
(stdlib 8.1.1) proc_lib.erl:333: :proc_lib.init_p_do_apply/3🤷♂️ |
Member
Author
|
defmodule Chat.MixProject do
use Mix.Project
def project do
[
app: :chat,
version: "1.8.16",
elixir: "~> 1.17",
elixirc_paths: elixirc_paths(Mix.env()),
start_permanent: Mix.env() == :prod,
aliases: aliases(),
deps: deps(),
compilers: [:phoenix_live_view] ++ Mix.compilers(),
listeners: [Phoenix.CodeReloader],
test_coverage: [tool: ExCoveralls]
]
end
# Configuration for the OTP application.
#
# Type `mix help compile.app` for more information.
def application do
[
mod: {Chat.Application, []},
extra_applications: [:logger, :runtime_tools]
]
end
def cli do
[
preferred_envs: [
c: :test,
ci: :test,
coveralls: :test,
"coveralls.detail": :test,
"coveralls.json": :test,
"coveralls.post": :test,
"coveralls.html": :test,
precommit: :test,
t: :test
]
]
end
# Specifies which paths to compile per environment.
defp elixirc_paths(:test), do: ["lib", "test/support"]
defp elixirc_paths(_), do: ["lib"]
# Specifies your project dependencies.
#
# Type `mix help deps` for examples and options.
defp deps do
[
{:phoenix, "~> 1.8.16"},
{:phoenix_ecto, "~> 4.5"},
{:ecto_sql, "~> 3.13"},
{:postgrex, ">= 0.0.0"},
{:phoenix_html, "~> 4.1"},
{:phoenix_live_reload, "~> 1.2", only: :dev},
{:phoenix_live_view, "~> 1.2.1"},
{:lazy_html, ">= 0.1.0", only: :test},
{:esbuild, "~> 0.10", runtime: Mix.env() == :dev},
{:tailwind, "~> 0.5", runtime: Mix.env() == :dev},
{:heroicons, "~> 0.5.5"},
{
:daisyui,
github: "saadeghi/daisyui",
tag: "v5.7.50",
sparse: "packages/bundle",
app: false,
compile: false,
depth: 1
},
{:floki, ">= 0.30.0", only: :test},
{:telemetry_metrics, "~> 1.0"},
{:telemetry_poller, "~> 1.0"},
{:jason, "~> 1.2"},
{:dns_cluster, "~> 0.2.0"},
{:bandit, "~> 1.5"},
# Test coverage: github.com/parroty/excoveralls
{:excoveralls, "~> 0.18.0", only: [:test, :dev]},
# Tidy Code: credo.hexdocs.pm
{:credo, "~> 1.7", only: [:dev, :test], runtime: false},
# Auth: github.com/dwyl/auth_plug
{:auth_plug, "~> 1.6"}
]
end
# Aliases are shortcuts or tasks specific to the current project.
# For example, to install project dependencies and perform other setup tasks, run:
#
# $ mix setup
#
# See the documentation for `Mix` for more info on aliases.
defp aliases do
[
setup: ["deps.get", "ecto.setup", "assets.setup", "assets.build"],
"ecto.setup": ["ecto.create", "ecto.migrate", "run priv/repo/seeds.exs"],
"ecto.reset": ["ecto.drop", "ecto.setup"],
test: ["ecto.create --quiet", "ecto.migrate --quiet", "test"],
"assets.setup": ["tailwind.install --if-missing", "esbuild.install --if-missing"],
"assets.build": ["compile", "tailwind chat", "esbuild chat"],
"assets.deploy": [
"tailwind chat --minify",
"esbuild chat --minify",
"phx.digest"
],
precommit: ["compile --warnings-as-errors", "deps.unlock --unused", "format", "test"],
c: ["coveralls.html"],
ci: ["coveralls.json"],
s: ["phx.server"],
t: ["test"]
]
end
end |
Member
Author
Member
Author
|
Superseded by: #352 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

This PR updates the project to latest
Phoenix(v1.8.9)deleteold project files ✂️