mirror of
https://github.com/warmbly/warmbly.git
synced 2026-08-26 08:00:42 +00:00
Matthew Meszaros
d8bb10bf8f
Workflow: - Add explicit `permissions: contents: read, pull-requests: read` so dorny/paths-filter can list PR files via the GitHub API. Without it the "Detect Changes" job dies with "Bad credentials" on PRs and every downstream language CI gets skipped. Go: - google.golang.org/grpc v1.78.0 → v1.79.3 (CVE-2026-33186 — HTTP/2 path validation authorization bypass). Elixir (realtime): - cowboy 2.14.2 → 2.15.0 (CVE-2026-8466) - cowlib 2.16.0 → 2.16.1 (CVE-2026-43970, CVE-2026-7790) - phoenix 1.8.3 → 1.8.7 (CVE-2026-32689 — long-poll memory blow-up) - plug 1.19.1 → 1.19.2 (CVE-2026-8468 — multipart header overflow) - plug_cowboy 2.7.5 → 2.8.1 (CVE-2026-32688 — unauth DoS) - postgrex 0.22.0 → 0.22.2 (CVE-2026-32687 — channel-name SQLi) Rust (tracking): - aws-lc-rs 1.15.4 → 1.17.0 (pulls aws-lc-sys to 0.41.0 — fixes GHSA-394x-vwmw-crm3, GHSA-65p9-r9h6-22vj, GHSA-9f94-5g5w-gf6r, GHSA-hfpc-8r3f-gw53, GHSA-vw5v-4f2q-w9xf) - openssl 0.10.75 → 0.10.80 (CVE-2026-41676/8/81/898, -42327) - rustls-webpki 0.103.9 → 0.103.13 - Add .trivyignore for GHSA-82j2-j2ch-gfr8 on the old rustls-webpki 0.101.7 path that aws-smithy-http-client / hyper-rustls 0.24 still pulls in. AWS SDK hasn't migrated to rustls 0.23+ yet; the CRL parsing path the advisory covers isn't reachable from our usage (SSM + Secrets Manager at startup over the public CA chain).