Repository navigation
Conversation
Every advisory fixed in #81 to #84 was found by chance, in mix deps.get output that warns but never fails. This workflow makes CI fail instead: - `mix hex.audit` checks mix.lock against Hex's advisory feed (and retired packages). Hex 2.5 is the first release that checks advisories, so the job installs the latest Hex. - `cargo audit` checks Cargo.lock against the RustSec database. cargo-audit takes about three minutes to build, so its binary is cached per version. A lock file can become vulnerable without any change in this repository, so the workflow also runs daily on main. Against the lock files from before those fixes, hex.audit reports six advisories in decimal 3.1.1 and mint 1.9.3, and cargo audit reports RUSTSEC-2026-0285 in rustls 0.23.41. Both exit 1. On current main both pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6
Contributors and agents should know that an advisory fails CI, that the fix is an upgrade, and where an advisory that does not affect Textbin can be acknowledged, with a reason. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every advisory fixed in #81–#84 was found by chance, in
mix deps.getoutput that warns but never fails. This PR adds anauditworkflow that fails CI instead.mix hex.auditcargo audit(0.22.2)Cargo.lockmain, and daily at 06:17 UTC onmain. A lock file can become vulnerable without any change here, so PR runs alone would miss new advisories.hex.auditchecks security advisories, not just retirements. The job runsmix local.hex --forceto get the latest.depsis cached bymix.lock.hex: [ignore_advisories: [...]]inmix.exsor to.cargo/audit.toml, with a reason. The workflow header and AGENTS.md both say this.Verification
main, both pass locally:mix hex.auditreports none, andcargo auditscans 379 crates and finds nothing.mix hex.auditin a worktree at cb3a894 (before fix(deps): upgrade bandit, decimal, mint and lazy_html for security advisories #81) lists six advisories in decimal 3.1.1 and mint 1.9.3, including CVE-2026-91043 (HIGH), and exits 1.cargo auditagainst theCargo.lockfrom before chore(deps): upgrade the CLI's Rust dependencies and cargo-dist #83 reports RUSTSEC-2026-0285 in rustls 0.23.41 and exits 1.actionlintisn't installed here. The YAML parses, and this PR's own run of the workflow is the real test.🤖 Generated with Claude Code
https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6
Generated by Claude Code