Skip to content

AshReplicant 1.3.0

Choose a tag to compare

View all tags
@palermo-git palermo-git released this 22 Sep 09:34
v1.3.0
9bd9a39

AshReplicant 1.3.0

The security-floor release. Install:

{:ash_replicant, "~> 1.3.0"}

Security

  • AshCloak requirement moves to >= 0.4.0 and < 1.0.0-0 (lock 0.4.0).
    Every earlier AshCloak release carries two advisories, both fixed only
    in 0.4.0: EEF-CVE-2026-81319 (unsafe deserialization of decrypted
    terms enables node DoS; CVE-2026-81319 / GHSA-rc26-mrm2-6pf9) and
    EEF-CVE-2026-81322 (cloaked plaintext leaks through a non-sensitive
    action argument; CVE-2026-81322 / GHSA-qp4v-vvrg-8ggx). The previous
    ~> 0.1 range could resolve a consumer onto a vulnerable version;
    this package now refuses to, and mix deps.audit runs clean.
    ash_replicant owns no decrypt path (writes route through the host
    actions where AshCloak's before_action hook fires), so no code change
    rides along.

Changed

  • AshOnetime >= 1.3.2 and < 2.0.0-0 (lock 1.3.2) with the companion
    floors Ash >= 3.33.4 and < 4.0.0-0, AshPostgres ~> 2.13, and
    optional Igniter >= 0.8.4 and < 1.0.0-0.
  • Consumers pin Ash's string-length counting basis in their own host
    config: config :ash, default_string_length_count: :codepoints.
  • The selector-free packaging commands clear all three dependency
    selectors, so an exported selector can no longer pin built package
    metadata to a single version instead of the published ranges.
  • Replicant lock 1.2.4 within the unchanged
    >= 1.2.3 and < 2.0.0-0 floor. Dev-only dialyxir/ex_doc refreshes
    (not shipped in the package).

Fixed

  • The start-link lifecycle suite carries an explicit 180-second
    ceiling on every port-1 activation test, and the six-case
    transport-options loop is split into one test per option: each
    activation's code fingerprint walks the serialized Erlang code
    server, and a saturated CI runner stretched a walk from ~150ms
    toward minutes (the timeout also leaked the logger error that
    tripped the structural no-error gate). A starved runner now costs
    one named test instead of the whole chain.
  • CI pins ubuntu-24.04 instead of the floating ubuntu-latest
    label: GitHub migrates the label to Ubuntu 26 on October 19, 2026,
    and the release contract should not ride a silently migrating
    runner image. The pin is behavior-neutral today.

No public API change (ADR-0023 freeze intact). Full changelog:
CHANGELOG.md. Battery of record: the green CI run on the release
head. Artifact: ash_replicant-1.3.0.tar SHA-256
09efe581d928a755b98825adc4643522f4341786518fcee0f2a5e38b41ff133e.

Assets 2
Loading