Repository navigation
fix: restore CI: patch advisories and download Lumis's NIF from its mirror - #91
Merged
Merged
Conversation
- plug_crypto 2.2.0 -> 2.2.1 (EEF-CVE-2026-105963) - bandit 1.12.5 -> 1.13.1 (EEF-CVE-2026-105659, EEF-CVE-2026-105660), with thousand_island 1.5.0 -> 1.6.0 - rustls 0.23.45 -> 0.23.46 (RUSTSEC-2026-0346, -0347, -0348, -0349) - ctutils 0.4.3 -> 0.4.5 (RUSTSEC-2026-0385) - rustls-webpki and webpki-root-certs to their patched releases (RUSTSEC-2026-0382, RUSTSEC-2026-0383)
Since OTP 28.5.0.6, :httpc rejects responses with more than 10 KiB of
headers (OTP-20343). GitHub's release-download redirect now sends about
10.9 KiB, so RustlerPrecompiled fails to download Lumis's NIF with
{:header_too_long, {:max, 10240}} and compilation fails in CI.
Use Lumis's documented Cloudflare R2 mirror, which serves the same files
directly with about 700 bytes of headers. RustlerPrecompiled still checks
them against the checksums shipped in the Lumis package.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI fails on
mainand on every pull request for two independent reasons. This fixes both.Advisories (
auditworkflow). Patch and minor upgrades of every dependency with a published advisory:Textbin sets no Bandit or Thousand Island options. Bandit 1.13 now rejects HTTP/1.1 requests without a valid
Hostheader.Lumis NIF download (
elixirworkflow). Since OTP 28.5.0.6 (OTP-20343),:httpcrejects responses with more than 10 KiB of headers. CI installs OTP 28.5.0.8, and GitHub's release-download redirect now sends about 10.9 KiB, mostly a 9 KiBcontent-security-policy. RustlerPrecompiled therefore fails to download Lumis's NIF with{:header_too_long, {:max, 10240}}, and every job that compiles fails.config :lumis, artifact_source: :cloudflareswitches to Lumis's documented Cloudflare R2 mirror. It serves the same files directly, with about 700 bytes of headers, and RustlerPrecompiled still checks them against the checksums in the Lumis package. The line can go once RustlerPrecompiled raises the limit (philss/rustler_precompiled#113).Verified locally:
mix hex.auditandcargo auditare clean.mix testpasses (582 tests) andcargo testpasses.artifacts.lumis.sh. Clean-cache dev and prod compiles succeed from the mirror.