Repository navigation
fix(s061): beam_mcp 0.10.1, the security patch hex.audit asks for - #127
Merged
Merged
Conversation
mix hex.audit refuses beam_mcp 0.9.0 since 2026-10-08 for EEF-CVE-2026-88257 (nested tool argument constraints advertised but not enforced) and EEF-CVE-2026-104634 (JSON booleans and null reached dispatch as strings), which turned the gate red on every branch. 0.10.1 fixes both; 0.10.0 changed copy and CI only, and the pin (~> 0.10.1) excludes the affected releases. The MCP suite passes on 0.10.1 (62 tests), including the catalog load that now refuses a schema keyword it would not enforce; the full gate passes. Signed-off-by: Ayla Croft <aylacroft@proton.me>
This was referenced Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since 2026-10-08
mix hex.auditrefusesbeam_mcp0.9.0, somix gatefails onmainand on every branch:true,falseandnullreached dispatch as strings.0.10.1 (2026-09-26) fixes both. 0.10.0 changed copy and CI only. The pin moves to
~> 0.10.1, so neither affected release can resolve.Two behaviours change in 0.10.1 because the old ones were the defects: booleans and null now reach Trinity's MCP server as themselves, and a tool schema keyword outside the enforced subset is refused when the catalog loads. Trinity's exported tools use none, and the MCP suite passes (62 tests). Local
mix gate: exit 0, 1034 tests.Changed:
mix.exs,mix.lock, thebeam_mcpentry inlib/trinity/versions.exand the regeneratedVERSIONS.mdandTHIRD_PARTY_LICENSES.md, and the test that pins the locked version.Every other open PR needs this before its gate can pass.