deps - CI - fangorn/ex_git_objectstore


      fangorn/ex_git_objectstore

public

ref:main

deps passed

Command:

set -e
git config --global --add safe.directory /workspace
export MIX_HOME=/workspace/.mix
mix local.hex --force && mix local.rebar --force
mix deps.get

Runner: DESKTOP-12GQBKK paused linux/x86_64

Started: Jul 31, 2026 at 06:33 UTC Completed: Jul 31, 2026 at 06:33 UTC Duration: 4s

Exit code:

Build Output

Using cached prepared image: anvil-prepared:cfa6aaa93a51

* creating .mix/archives/hex-2.5.1

* creating .mix/elixir/1-20-otp-29/rebar3

Resolving Hex dependencies...

Resolution completed in 0.062s

Unchanged:

bandit 1.11.1 VULNERABLE!

EEF-CVE-2026-65623 (HIGH)

aka: CVE-2026-65623, GHSA-vg8x-66vg-5pxh

Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

https://osv.dev/vulnerability/EEF-CVE-2026-65623

bunt 1.0.0

credo 1.7.18

dialyxir 1.4.7

earmark_parser 1.4.44

erlex 0.2.9

ex_aws 2.6.1

ex_aws_s3 2.5.9

ex_doc 0.40.3

file_system 1.1.1

finch 0.22.0

hpax 1.0.3 VULNERABLE!

EEF-CVE-2026-58226 (HIGH)

aka: CVE-2026-58226, GHSA-jj2p-32j7-whj2

Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax

https://osv.dev/vulnerability/EEF-CVE-2026-58226

jason 1.4.5

makeup 1.2.1

makeup_elixir 1.0.1

makeup_erlang 1.1.0

mime 2.0.7

mint 1.9.0 VULNERABLE!

EEF-CVE-2026-58229 (HIGH)

aka: CVE-2026-58229, GHSA-qrfr-wh4c-3qhw

Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS

https://osv.dev/vulnerability/EEF-CVE-2026-58229

EEF-CVE-2026-59246 (MEDIUM)

aka: CVE-2026-59246, GHSA-8pf6-g464-h6h9

Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory

https://osv.dev/vulnerability/EEF-CVE-2026-59246

EEF-CVE-2026-56810 (HIGH)

aka: CVE-2026-56810, GHSA-c59h-fq4p-r36r

mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5

https://osv.dev/vulnerability/EEF-CVE-2026-56810

EEF-CVE-2026-59249 (MEDIUM)

aka: CVE-2026-59249, GHSA-x3x7-96vm-6h2w

Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections

https://osv.dev/vulnerability/EEF-CVE-2026-59249

nimble_options 1.1.1

nimble_parsec 1.4.2

nimble_pool 1.1.0

plug 1.19.2 VULNERABLE!

EEF-CVE-2026-56814 (MEDIUM)

aka: CVE-2026-56814, GHSA-95qv-c9g9-rm63

Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

https://osv.dev/vulnerability/EEF-CVE-2026-56814

EEF-CVE-2026-54892 (HIGH)

aka: CVE-2026-54892, GHSA-j43x-5hjq-rgxf

Plug: quadratic-time decoding of nested query/body parameters enables denial of service

https://osv.dev/vulnerability/EEF-CVE-2026-54892

EEF-CVE-2026-56813 (LOW)

aka: CVE-2026-56813, GHSA-wpmj-jh88-rpgm

Cookie attribute injection in Plug.Conn.Cookies.encode/2

https://osv.dev/vulnerability/EEF-CVE-2026-56813

plug_crypto 2.1.1

req 0.5.18 VULNERABLE!

EEF-CVE-2026-49756 (LOW)

aka: CVE-2026-49756, GHSA-px9f-whj3-246m

Multipart form-data header injection in Req via unescaped name/filename/content_type

https://osv.dev/vulnerability/EEF-CVE-2026-49756

EEF-CVE-2026-49755 (HIGH)

aka: CVE-2026-49755, GHSA-655f-mp8p-96gv

Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies

https://osv.dev/vulnerability/EEF-CVE-2026-49755

stream_data 1.3.0

sweet_xml 0.7.5

telemetry 1.4.2

thousand_island 1.5.0

websock 0.5.3

Found packages with security advisories, see above for details

All dependencies have been fetched

Back to run Back to CI