chore(deps): let cowboy come from nova - #411
Merged
Merged
Conversation
cowboy became a direct dependency in #234 to force a patched 2.18 past nova's exact 2.15.0 pin, which was vulnerable to CVE-2026-43966. nova 0.15.3 pins 2.18.0 itself, so the override has done its job and asobi should not be second-guessing which cowboy its web framework runs on. cowboy still resolves to 2.18.0, now transitively at depth 1 rather than declared at depth 0, so nothing about the running code changes and the CVE stays fixed. rebar3 audit reports no vulnerabilities across all 21 dependencies. asobi does call cowboy_req directly, 186 times, so this is not a case of dropping something unused. It is that nova pins cowboy exactly, which leaves a direct constraint here redundant when it agrees and a build failure when it does not. Verified on a clean _build: eunit 1661 tests, ct 341 tests against Postgres 17, plus audit, xref, dialyzer and fmt.
🟡 Code Coverage — 75.7%6862 of 9070 lines covered. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cowboy became a direct dependency in #234 to force a patched 2.18 past nova's exact
2.15.0pin, which was vulnerable to CVE-2026-43966. nova 0.15.3 pins 2.18.0 itself, so the override has done its job.Why this matters beyond tidiness
nova pins cowboy exactly (
{cowboy, "2.18.0"}), not as a range. A direct constraint in asobi therefore has only two outcomes: it agrees with nova and is redundant, or it disagrees and either breaks the build or wins and hands nova a cowboy it was never tested against. nova is the code calling cowboy's internals; asobi only borrows theReqnova hands it. So nova owns the version.Nothing about the running code changes
cowboy still resolves to 2.18.0, now transitively at depth 1 rather than declared at depth 0.
rebar3 auditreports no vulnerabilities across all 21 dependencies.Correction to the original description
This PR originally said asobi calls
cowboy_req"186 times". That number was wrong - it came from a grep that also matched thecowboy_req:req()type in-specannotations. The accurate figures:cowboy_req:req()type annotations, required becausenova_plugin's callbacks are themselves declared in terms ofcowboy_req:req()The conclusion is unchanged - this is not dropping an unused dependency - but the scale is much smaller than stated. Every REST controller is Nova-clean with zero cowboy calls. The 34 are concentrated in plugins (14, because
nova_plugin:pre_request/4has no way to send a response), the ops/console session and CSRF cookie handling (16), and three small helpers (4).cowboywas never inasobi.app.src'sapplicationslist, so start order is unaffected.Verification
Clean
_build:rebar3 audit: no vulnerabilities in 21 depsfmt --checkclean