Skip to content

Commit 8f5526a

Browse files
committed
deps: mint 1.11.0, clearing three advisories
mix deps.audit reported three against mint 1.10.1: EEF-CVE-2026-91043 (HIGH) HPACK-indexed cookie fields in HTTP/2 responses bypass max_header_list_size and exhaust client memory EEF-CVE-2026-94194 (MEDIUM) chunked framing applied when chunked is not the final transfer coding, enabling response smuggling through intermediaries EEF-CVE-2026-92103 (MEDIUM) HTTP/2 frames buffered up to 16 MiB before max_frame_size is enforced mint is transitive, through finch, whose requirement is ~> 1.8 and already admits 1.11.0, so no requirement in mix.exs had to change and none did. hpax 1.0.4 => 1.1.0 comes with it and is not optional: mint 1.11.0 requires hpax ~> 1.1, where 1.10.1 required ~> 0.1.1 or ~> 0.2.0 or ~> 1.0. Those two lines are the whole of the lock change. THIRD_PARTY_LICENSES.md is regenerated with `mix trinity.third_party_licenses --write`, which the gate checks against the bill of materials. It is two lines, the same two versions, and neither licence changed: both remain Apache-2.0. Signed-off-by: Ayla Croft <aylacroft@proton.me>
1 parent e330eea commit 8f5526a

2 files changed

Lines changed: 4 additions & 4 deletions

File tree

‎THIRD_PARTY_LICENSES.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ it, and a reader should not infer from an entry here that the component is in a
6363
| `heroicons` | `0435d4ca364a` | MIT | declared |
6464
| `hex` | `2.5.1` | Apache-2.0 | bom |
6565
| `hex_core` | `0.19.0` | Apache-2.0 | bom |
66-
| `hpax` | `1.0.4` | Apache-2.0 | bom |
66+
| `hpax` | `1.1.0` | Apache-2.0 | bom |
6767
| `idna` | `7.1.0` | MIT | bom |
6868
| `igniter` | `0.8.4` | MIT | bom |
6969
| `inets` | `9.6.2.2` | Apache-2.0 | bom |
@@ -82,7 +82,7 @@ it, and a reader should not infer from an entry here that the component is in a
8282
| `mdex` | `0.13.5` | MIT | bom |
8383
| `mdex_native` | `0.2.8` | MIT | bom |
8484
| `mime` | `2.0.7` | Apache-2.0 | bom |
85-
| `mint` | `1.10.1` | Apache-2.0 | bom |
85+
| `mint` | `1.11.0` | Apache-2.0 | bom |
8686
| `mix` | `1.20.4` | Apache-2.0 | bom |
8787
| `mix_audit` | `2.1.5` | BSD-3-Clause | bom |
8888
| `mox` | `1.3.1` | Apache-2.0 | bom |

‎mix.lock‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
"glob_ex": {:hex, :glob_ex, "0.1.12", "7b2d9369c20e2697efcfd185d13d6e84c94cd3bfd2730fbde613141c2e015c00", [:mix], [], "hexpm", "2e2fac83f113514434c7eaf267b4c38af2f91766f1cab2c5db7053b7fc1ee0bb"},
3737
"heroicons": {:git, "https://github.com/tailwindlabs/heroicons.git", "0435d4ca364a608cc75e2f8683d374e55abbae26", [tag: "v2.2.0", sparse: "optimized", depth: 1]},
3838
"hex_core": {:hex, :hex_core, "0.19.0", "b9b5d3cde2d5227b85c62c4ab9f9db586e6b38cf65a9bf5b683757cae9ced5eb", [:rebar3], [], "hexpm", "c2cc414f3893a7edbcab28207cadca13829407abe41f689c82f379fe22f026a5"},
39-
"hpax": {:hex, :hpax, "1.0.4", "777de5d433b0fbdc7c418159c8055910faa8047ffdb3d6b31098d2a46cd7685c", [:mix], [], "hexpm", "afc7cb142ebcc2d01ce7816190b98ce5dd49e799111b24249f3443d730f377ca"},
39+
"hpax": {:hex, :hpax, "1.1.0", "782931867cc23217c68fb5f68fe1a11f5e7544c7fda82c8a7019a5df5a4a1cdf", [:mix], [], "hexpm", "0b8d0f05832f55571d65ac720f79bf8994138ffbb133209dc4685eae0ad456a8"},
4040
"idna": {:hex, :idna, "7.1.0", "1067a13043538129602d2f2ce6899d8713125c7d19734aa557ce2e3ea55bd4f1", [:rebar3], [], "hexpm", "6ae959a025bf36df61a8cab8508d9654891b5426a84c44d82deaffd6ddf8c71f"},
4141
"igniter": {:hex, :igniter, "0.8.4", "f79f1bbdc2fb7b9ca030a22d12a585b060cbf5b94b9d3f23b1148578a9e05d11", [:mix], [{:ex_ast, "~> 0.5", [hex: :ex_ast, repo: "hexpm", optional: false]}, {:glob_ex, "~> 0.1.7", [hex: :glob_ex, repo: "hexpm", optional: false]}, {:jason, "~> 1.4.5", [hex: :jason, repo: "hexpm", optional: false]}, {:owl, "~> 0.11", [hex: :owl, repo: "hexpm", optional: false]}, {:phx_new, "~> 1.7", [hex: :phx_new, repo: "hexpm", optional: true]}, {:req, "~> 0.5", [hex: :req, repo: "hexpm", optional: false]}, {:rewrite, ">= 1.1.1 and < 2.0.0-0", [hex: :rewrite, repo: "hexpm", optional: false]}, {:sourceror, "~> 1.4", [hex: :sourceror, repo: "hexpm", optional: false]}, {:spitfire, ">= 0.1.3 and < 1.0.0-0", [hex: :spitfire, repo: "hexpm", optional: false]}], "hexpm", "a9b1cbec996ccb100b4f7d8130129b2dd3f18eb4224ac9a0e907e428ca90dbd7"},
4242
"jason": {:hex, :jason, "1.4.5", "2e3a008590b0b8d7388c20293e9dcc9cf3e5d642fd2a114e4cbbb52e595d940a", [:mix], [{:decimal, "~> 1.0 or ~> 2.0 or ~> 3.0", [hex: :decimal, repo: "hexpm", optional: true]}], "hexpm", "b0c823996102bcd0239b3c2444eb00409b72f6a140c1950bc8b457d836b30684"},
@@ -52,7 +52,7 @@
5252
"mdex": {:hex, :mdex, "0.13.5", "c1c94d230ccaab01ad0c68090d3b31613c10ece1844f32b55895da4ce0c63029", [:mix], [{:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:lumis, "~> 0.1", [hex: :lumis, repo: "hexpm", optional: true]}, {:mdex_native, ">= 0.2.6", [hex: :mdex_native, repo: "hexpm", optional: false]}, {:nimble_options, "~> 1.0", [hex: :nimble_options, repo: "hexpm", optional: false]}, {:nimble_parsec, "~> 1.0", [hex: :nimble_parsec, repo: "hexpm", optional: false]}, {:phoenix_live_view, "~> 0.20.0 or ~> 1.0", [hex: :phoenix_live_view, repo: "hexpm", optional: true]}], "hexpm", "c57409fb6b34fbc58fbce0a6da670c9a4b5a2e94f86abdc56e9e213ed74620f2"},
5353
"mdex_native": {:hex, :mdex_native, "0.2.8", "20b7cbf330c1ca81b8da4132b8d01952cded11f6dfc2abe8fef25c13681b15e4", [:mix], [{:rustler, "~> 0.32", [hex: :rustler, repo: "hexpm", optional: true]}, {:rustler_precompiled, "~> 0.8", [hex: :rustler_precompiled, repo: "hexpm", optional: false]}], "hexpm", "004a5565b6c96a06400901eb1e4e603585e00b23262d3f595c3f4aa38b83ef66"},
5454
"mime": {:hex, :mime, "2.0.7", "b8d739037be7cd402aee1ba0306edfdef982687ee7e9859bee6198c1e7e2f128", [:mix], [], "hexpm", "6171188e399ee16023ffc5b76ce445eb6d9672e2e241d2df6050f3c771e80ccd"},
55-
"mint": {:hex, :mint, "1.10.1", "c53e70867cf74017716884d8d33e0742b08b32e9cdb0031cbc69a429dc5555e3", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}, {:hpax, "~> 0.1.1 or ~> 0.2.0 or ~> 1.0", [hex: :hpax, repo: "hexpm", optional: false]}], "hexpm", "0ba2a904605ed8406393444fb8b3356dc58eb59ee6c7fb94ac3f015e1be129e8"},
55+
"mint": {:hex, :mint, "1.11.0", "a713551624815c0435237b93d90ea8b9b14254690c66f732d0ef8930f76ff1d9", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}, {:hpax, "~> 1.1", [hex: :hpax, repo: "hexpm", optional: false]}], "hexpm", "c6279ba2d6aa3a383a1d4cfbe7b59f42e6efd400f58d8e2acfeac48a438693ab"},
5656
"mix_audit": {:hex, :mix_audit, "2.1.5", "c0f77cee6b4ef9d97e37772359a187a166c7a1e0e08b50edf5bf6959dfe5a016", [:make, :mix], [{:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:yaml_elixir, "~> 2.11", [hex: :yaml_elixir, repo: "hexpm", optional: false]}], "hexpm", "87f9298e21da32f697af535475860dc1d3617a010e0b418d2ec6142bc8b42d69"},
5757
"mox": {:hex, :mox, "1.3.1", "ccd9ddeacc1eb1e4fe9ac42f99fcb49b214e3529b8c3b1bd7a60bc803a46f536", [:mix], [{:nimble_ownership, "~> 1.0", [hex: :nimble_ownership, repo: "hexpm", optional: false]}], "hexpm", "6aa44b17e40abed6c6d501e6393d229f2820fb69c5971fd17fe0d7f7eefa41fd"},
5858
"muontrap": {:hex, :muontrap, "2.0.0", "2cb7dfd16a7a957f16fbc50f11bda5a04ce511e96a771e7141b3ef7ad15a2046", [:make, :mix], [{:elixir_make, "~> 0.6", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "8bf8fdbd8ca34c10ef02fc88be43bbfd6697781fa13fe0b3c6b1f6e43c4ef705"},

0 commit comments

Comments
 (0)