White_Ghost_Cyber_Systems/traefik-control
3
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases 4 Packages 2 Wiki Activity Actions

chore(deps): update bandit and audit dependencies in ci #24

Merged
ryan.mcgee merged 1 commit from ci/dependency-audit into main 2026-10-15 19:25:58 +00:00
Conversation 0 Commits 1 Files changed 3 +29 -2
ryan.mcgee commented 2026-10-15 19:14:27 +00:00
Owner
Copy link

Summary

  • mix hex.audit reported two Bandit advisories (HTTP/2 stream pinning, HIGH; HTTP/1 request-target authority choosing conn.host/conn.port, MEDIUM). Bandit 1.13.0 fixes them, so update it and keep watching.

Changes

  • mix.lock: bandit 1.12.5 to 1.13.0, thousand_island 1.5.0 to 1.6.0 (the only changes).
  • CI: new dependency audit job running mix hex.audit, on pull requests and every Monday 06:00 UTC. It is not in the required checks on purpose, so an advisory published tomorrow is visible without blocking unrelated merges.
  • README: describes the job.

Verification

  • mix hex.audit before: 2 advisories, exit 1. After: "No retired or security advisory packages found".
  • format, compile with warnings as errors, credo strict, dialyzer: clean. mix test: 1492 passed on SQLite and on PostgreSQL.
## Summary - `mix hex.audit` reported two Bandit advisories (HTTP/2 stream pinning, HIGH; HTTP/1 request-target authority choosing `conn.host`/`conn.port`, MEDIUM). Bandit 1.13.0 fixes them, so update it and keep watching. ## Changes - `mix.lock`: bandit 1.12.5 to 1.13.0, thousand_island 1.5.0 to 1.6.0 (the only changes). - CI: new `dependency audit` job running `mix hex.audit`, on pull requests and every Monday 06:00 UTC. It is not in the required checks on purpose, so an advisory published tomorrow is visible without blocking unrelated merges. - README: describes the job. ## Verification - `mix hex.audit` before: 2 advisories, exit 1. After: "No retired or security advisory packages found". - format, compile with warnings as errors, credo strict, dialyzer: clean. `mix test`: 1492 passed on SQLite and on PostgreSQL.
chore(deps): update bandit and audit dependencies in ci
All checks were successful
CI / tests (SQLite) (pull_request) Successful in 4m21s
Details
CI / format, compile, credo, dialyzer (pull_request) Successful in 8m30s
Details
CI / dependency audit (pull_request) Successful in 36s
Details
CI / tests (PostgreSQL) (pull_request) Successful in 4m34s
Details
c7a22a9ce9 
- update bandit 1.12.5 to 1.13.0 (and thousand_island to 1.6.0),
  which fixes two published advisories
- add a dependency audit job (mix hex.audit) on pull requests and
  weekly; not a required check, so a new advisory does not block
  unrelated merges
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
White_Ghost_Cyber_Systems/traefik-control!24
No description provided.