run-hex-advisory-check shipped in v2.16.0 (#67) but is off by default, so every Elixir repo on @v2 still has the blind spot it was added to close. This tracks the per-repo opt-in.
Why it can't just be default-on
mix_audit — what run-deps-audit runs — resolves advisories from exactly one source, mirego/elixir-security-advisories. Anything not in that mirror is not reported at all. Measured on HordiaLabs/scraper-control, same mix.lock, same machine:
$ mix deps.audit
No vulnerabilities found.
$ mix deps.get
bandit 1.12.4 VULNERABLE!
EEF-CVE-2026-74836 (HIGH)
EEF-CVE-2026-75484 (MEDIUM)
The mirror clone was already at upstream HEAD and neither advisory exists in it, so this is missing data rather than a stale cache — a rebuild or cache-bust wouldn't surface it. Any repo relying on run-deps-audit alone is exposed the same way.
Default stays false because flipping it fleet-wide would red-line any repo whose deps carry an untriaged advisory, with no warning and no chance to assess first. Opt-in keeps that a decision rather than a surprise.
Per-repo steps
- Run
mix deps.get locally and note any VULNERABLE! blocks.
- Upgrade what's upgradable.
- For anything genuinely unadoptable, add the id to
hex-advisory-ignore with a comment saying why and what unblocks it — e.g. scraper-control ignores GHSA-rhv4-8758-jx7v because decimal 3.0 has the fix but ecto pins decimal ~> 2.0.
- Set
run-hex-advisory-check: true. Leave run-deps-audit: true — the sources are complementary, neither is a superset.
Ids match the primary id or any aka: alias, so GHSA ids already passed to mix_audit's --ignore-advisory-ids can be reused verbatim and both lists stay in one dialect.
Repos
Once coverage is broad enough that a default flip is uneventful, worth reconsidering default: true so new repos inherit the gate rather than having to know to ask for it.
🤖 Generated with Claude Code
run-hex-advisory-checkshipped in v2.16.0 (#67) but is off by default, so every Elixir repo on@v2still has the blind spot it was added to close. This tracks the per-repo opt-in.Why it can't just be default-on
mix_audit— whatrun-deps-auditruns — resolves advisories from exactly one source,mirego/elixir-security-advisories. Anything not in that mirror is not reported at all. Measured onHordiaLabs/scraper-control, samemix.lock, same machine:The mirror clone was already at upstream
HEADand neither advisory exists in it, so this is missing data rather than a stale cache — a rebuild or cache-bust wouldn't surface it. Any repo relying onrun-deps-auditalone is exposed the same way.Default stays
falsebecause flipping it fleet-wide would red-line any repo whose deps carry an untriaged advisory, with no warning and no chance to assess first. Opt-in keeps that a decision rather than a surprise.Per-repo steps
mix deps.getlocally and note anyVULNERABLE!blocks.hex-advisory-ignorewith a comment saying why and what unblocks it — e.g. scraper-control ignoresGHSA-rhv4-8758-jx7vbecause decimal 3.0 has the fix but ecto pinsdecimal ~> 2.0.run-hex-advisory-check: true. Leaverun-deps-audit: true— the sources are complementary, neither is a superset.Ids match the primary id or any
aka:alias, so GHSA ids already passed tomix_audit's--ignore-advisory-idscan be reused verbatim and both lists stay in one dialect.Repos
HordiaLabs/scraper-control— HordiaLabs/scraper-control#70@v2Once coverage is broad enough that a default flip is uneventful, worth reconsidering
default: trueso new repos inherit the gate rather than having to know to ask for it.🤖 Generated with Claude Code