[HackTuah]

mix deps.audit reported three advisories against mint 1.10.1, published upstream since the last green run. They were red on main, not introduced by any open branch.

advisory	severity	summary
EEF-CVE-2026-91043	HIGH	HPACK-indexed cookie fields in HTTP/2 responses bypass max_header_list_size and exhaust client memory
EEF-CVE-2026-94194	MEDIUM	chunked framing applied when chunked is not the final transfer coding, enabling response smuggling through intermediaries
EEF-CVE-2026-92103	MEDIUM	HTTP/2 frames buffered up to 16 MiB before max_frame_size is enforced

The change

$ git diff --stat mix.lock mix.exs
 mix.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

mint 1.10.1 => 1.11.0 and hpax 1.0.4 => 1.1.0. Nothing else in the lock moved.

mix.exs did not change, and did not need to. mint is transitive, through finch:

$ mix deps.tree | grep -iE "finch|mint"
│   │   ├── finch ~> 0.21 (Hex package)
│   │   │   ├── mint ~> 1.8 (Hex package)

~> 1.8 already admits 1.11.0, so there was no requirement to relax and none was added. Neither mint nor hpax is named in mix.exs.

The hpax bump is forced, not incidental:

$ grep '"mint"' mix.lock | grep -o '{:hpax[^}]*}'
{:hpax, "~> 1.1", ...}

$ git show origin/main:mix.lock | grep '"mint"' | grep -o '{:hpax[^}]*}'
{:hpax, "~> 0.1.1 or ~> 0.2.0 or ~> 1.0", ...}

mint 1.11.0 requires hpax ~> 1.1 and the lock held 1.0.4, so the two lines are the minimum that resolves.

Proof

$ mix deps.audit ; echo AUDIT=$?
No vulnerabilities found.
AUDIT=0

$ mix test ; echo TEST=$?
Finished in 119.1 seconds (2.3s async, 116.7s sync)
Result: 914 passed (20 properties, 894 tests), 18 excluded
TEST=0

$ mix gate
prod_check: PASS
3750 mods/funs, found no issues.
No vulnerabilities found.
trinity.names: OK over 669 tracked files
Result: 914 passed (20 properties, 894 tests), 18 excluded
trinity.coverage: 042 80.31% vs 005 80.31%: OK
GATE_EXIT=0

One extra file, and why

THIRD_PARTY_LICENSES.md, two lines, the same two versions. The gate refuses a bill of materials that does not match it:

** (Mix) THIRD_PARTY_LICENSES.md does not match the bill of materials.
   Run `mix trinity.third_party_licenses --write` and commit the result.

Regenerated with that command rather than edited by hand. Neither licence changed: mint and hpax are both still Apache-2.0. Nothing under lib/, no source change of any kind, no slice id.

A pre-existing flake seen on the way, not fixed here

One mix gate run failed on Trinity.Skills.RegistryTest, "AC3: a SKILL.md edited on disk is in the registry within 2 s without a rescan", at test/trinity/skills/registry_test.exs:118. It is load-sensitive by construction: it polls 1..100 with Process.sleep(20) and asserts the total stays within 2 s, so under full-suite parallelism the sleeps overrun. Run on its own it passed 5 times out of 5, at 316 to 317 ms each. Unrelated to this bump, and a candidate identity for the uncaptured single failure reported on #110. Left alone; say the word if you want it opened.

Not merged.