build(deps): bump mint (security), ex_doc, spitfire - #203
Merged
Conversation
added 2 commits
September 4, 2026 13:26
Security: fixes EEF-CVE-2026-82728 / GHSA-g83f-2j6r-q6m4 (HIGH, unbounded HTTP/1 status-line and chunk-extension buffering causing memory-exhaustion DoS) and EEF-CVE-2026-82729 / GHSA-7p8w-j234-7qc8 (MEDIUM, quadratic chunk-size parsing causing CPU-exhaustion DoS). Transitive dependency pulled in via finch (~> 1.8, satisfied by 1.10.0). No breaking changes per the upstream changelog. No call-site changes needed in this repo.
Safe patch updates, no behavioral changes affecting this repo: - ex_doc (dev-only doc generator): reproducible HTML/EPUB output, new :api_reference_noindex option, per-package HexDocs subdomain links, and doc-rendering bug fixes. No breaking changes. - spitfire (transitive, via igniter/rewrite): single bug fix for parsing parentheses around anonymous function arguments. No breaking changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Minor/patch dependency updates. No majors involved, no held items.
mintfinch ~> 1.8). Fixes GHSA-g83f-2j6r-q6m4 (HIGH — unbounded HTTP/1 status-line/chunk-extension buffering, memory-exhaustion DoS) and GHSA-7p8w-j234-7qc8 (MEDIUM — quadratic chunk-size parsing, CPU-exhaustion DoS). No breaking changes per upstream changelog.ex_doc:api_reference_noindexoption, doc-rendering bug fixes. No breaking changes.spitfireigniter/rewrite). Single bug fix for parsing parens around anonymous function args. No breaking changes.All other direct and transitive dependencies were already up to date (
mix hex.outdated --all).Verification
Ran the project's actual CI gate (
.github/workflows/ci.yml) locally, since this repo has nomix precommitalias:mix hex.audit— clean (no advisories/retired packages)mix deps.unlock --check-unused— cleanmix compile --warnings-as-errors— cleanmix format --check-formatted— cleanmix credo --strict --format=oneline— cleanmix test --warnings-as-errors --cover— 150 passed, 93.40% coverage (threshold 90%)Baseline (pre-update, at
a964ae1) was confirmed green on the same suite before any changes were made.Test plan