Repository navigation
chore(deps): refresh stable dependencies and Elixir 1.20.5 - #699
Merged
Merged
Conversation
mwoods79
enabled auto-merge
November 7, 2026 02:48
Clears the security advisories and retirement flagged by the dependency audit. assent stays on 0.2.13: its fix ships in 0.3.2, which needs ash_authentication 5.x. - ash_authentication 4.15.0 -> 4.15.1 (EEF-CVE-2026-110826) - ecto 3.14.2 -> 3.14.3 (EEF-CVE-2026-118391) - ash_sql 0.8.5 -> 0.8.8 (0.8.5 is retired) - ash 3.37.2 -> 3.37.3
ash_authentication 4.15.1 revokes existing sessions when a password changes. The profile email-change scenarios sign in during Background and then set a password, so they now need a fresh sign-in, matching how pending_email_change.feature orders the same steps.
The dependency audit flags assent 0.2.13 as critical. The fix only ships in assent 0.3.2, and every ash_authentication 4.x release caps assent below 0.3, so the patched version is unreachable without overriding. ash_authentication only calls assent from its OAuth strategies; huddlz uses the password strategy alone. Remove the override when moving to ash_authentication 5.x, which requires assent ~> 0.3.2 itself.
Overriding assent to 0.3.2 bypassed ash_authentication's own version requirement, which would also hide future incompatibilities. Keep assent on 0.2.13 as ash_authentication 4.x requires, and acknowledge EEF-CVE-2026-117656 in the audit instead. The advisory covers the Sign in with Apple callback; huddlz only uses the password strategy. ash_authentication 5.x requires the fixed assent release, so remove the ignore when upgrading to it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refresh 15 Hex dependencies and Elixir to 1.20.5, including Bandit and Phoenix.HTML security fixes, plus the October 27 Debian/Elixir images.
Adapt the saved-home-search BDD assertion for PhoenixTest 0.14, which rejects the previously ignored
query:option. The assertion checks the decoded time-zone parameter independently of unrelated search filters.Remaining security blocker
The previous dependency audit failed on Assent 0.2.13, critical CVE-2026-117656. The locked ash_authentication 4.15.0 requires Assent >0.2.0 and <0.3.0, excluding the patched 0.3.2 release. Assent 0.3 removes authentication APIs, so moving across that compatibility boundary requires a separately reviewed migration or a compatible upstream authentication release. No override or audit suppression was added.
The advisory concerns Sign in with Apple; this application configures password and API-key authentication only. Package presence alone does not establish application exposure. The unresolved audit finding remains a blocker.