Repository navigation
Bump plug_crypto/mint/cowlib for October advisories; drop four ignores - #1013
Merged
Merged
Conversation
CI's scheduled Security job failed 2026-10-24 on plug_crypto 2.2.0 (EEF-CVE-2026-105963, fixed in 2.2.1). The same audit window carried mint 1.10.1 (three advisories) and cowlib 2.20.0 (two, ignored) — mint 1.10.2 backports all three fixes without the 1.11.0 behavior change that Finch 0.23.0 breaks on, and cowlib 2.21.0 fixes CVE-2026-43969, so five ignore_advisories entries come out and the mint pin moves to >= 1.10.2. The cloak CVE-2026-94206 in the report needs no code: it affects Cloak.Ecto.PBKDF2, which loopctl never uses, and that was already reasoned in mix.exs and pinned by cloak_advisory_reachability_test.exs.
Owner
Author
|
Review round 1 (code) counted at |
The review of #1013 found both stale after the ignores came out: no_outbound_http2_test.exs still justified itself by mint ignore entries that no longer exist, and finch_timeout_reuse_test.exs pointed at the wrong section of mix.exs, described mint 1.10.1 (locked is 1.10.2), and told the reader the mint advisory entries could still go. Behaviour unchanged; both tests still pin it.
mkreyman
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The scheduled CI Security job failed 2026-10-24 (run 40052927924) on
mix hex.audit: plug_crypto 2.2.0 — EEF-CVE-2026-105963 (MEDIUM), the only un-acknowledged advisory. The report also linked EEF-CVE-2026-94206 (cloak_ecto PBKDF2) — that one needs no code, see below. Full inventory of what the audit window carried, and what this does with each:Phoenix.Token.verify/4)Cloak.Ciphers.AES.CTR,Cloak.Ecto.PBKDF2) are absent from compiled code: every vault cipher is AES.GCM, no field is PBKDF2-hashed.test/loopctl/vault/cloak_advisory_reachability_test.exsfails the moment either module is referenced or either version moves.The mint pin moves to
>= 1.10.2 and < 1.11.0: the sub-1.11.0 half still guards the Finch 0.23.0 receive-timeout crash (finch_timeout_reuse_test.exs), but it no longer costs a security fix. finch itself stays at 0.23.0 — 0.24.0 is not needed by any advisory and this PR keeps its diff to the advisories.Testing
mix hex.audit— green; the only remaining entries are the three kept ignores, each with its reasoning inmix.exs.mix test test/loopctl/net/finch_timeout_reuse_test.exs test/loopctl/vault/cloak_advisory_reachability_test.exs test/loopctl/net/no_outbound_http2_test.exs— 5 tests, 0 failures (the three tests that pin these exact decisions).mix precommitruns in the commit hook on this branch.Risk
Low. All three bumps are patch/minor releases within the same requirement ranges (
plug_cryptovia plug's~> 1.18… transitive,mintinside the explicit pin,cowlibvia cowboy's range). plug_crypto 2.2.1's change is stack-trace arg pruning on guard failures; mint 1.10.2 is the security backport with no behavior change; cowlib 2.21.0's delta over 2.20.0 is the cookie-encoder fix. The blast radius is outbound HTTP (Req/Finch) and signed-token verification — both covered by the suite.How to revert
git revertthis commit: it touches onlymix.exs(ignores + pin comment),mix.lock, andCHANGELOG.md. No migration, no code. Reverting restores plug_crypto 2.2.0 and re-fails the Security job, so a revert needs the ignores re-added.Review findings
hex: ignore_advisoriesfor reasoning that now lives indeps/0, described mint 1.10.1 (locked is 1.10.2), and told the reader the mint advisory entries could still go; all three refreshed