Ignore cowlib CVE-2026-43971 in hex.audit - #5102
Merged
Merged
Conversation
The lint job has been red on main since 18 August. mix hex.audit picks up a third cowlib advisory, CVE-2026-43971, and our ignore list only covered the other two. There is nothing to upgrade to. cowlib 2.19.0 is the newest release on Hex and it predates the advisory, so the only fix is a git commit with no release behind it. cowlib is transitive anyway, cowboy 2.18.0 pins it to >= 2.19.0. Verified with Hex 2.5.1, which is what CI installs. mix hex.audit now exits 0 with all three ignored, and deps.audit, format, credo and sobelow still pass.
Security Review ✅
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #5102 +/- ##
=====================================
Coverage 90.6% 90.6%
=====================================
Files 422 422
Lines 20035 20035
=====================================
+ Hits 18159 18160 +1
+ Misses 1876 1875 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
The first version argued we were stuck because there is no patched release. That is true but it is the weaker reason. The real one is that none of the three vulnerable functions are reachable from our dependency tree, which is what actually makes suppressing them safe. Checked each: nothing outside cowlib references cow_link or cow_http_struct_hd, and cowboy_req only calls cow_cookie parse_cookie/1,2 and setcookie/3, never cookie/1.
Twenty lines of rationale above a three line list was out of proportion, and it would go stale the moment cowlib ships. The per advisory reasoning lives in the PR description instead.
Code review caught three things in the comment. It said the functions are not reachable, which is too strong: cow_http_struct_hd and cow_link are both reachable from cowboy_req on their parse side. What actually holds is that all three advisories name header-building functions, and nothing in our tree calls those. Each ID now carries the function it covers, and the note about hex matching aliases is back, since that is what tells the next person an EEF or GHSA failure is already silenced by the CVE form.
cowboy_req has no link entry in parse_header_fun, so cow_link's parse side is not reachable that way. The PR body already said two; the comment generalised and overstated it.
midigofrank
approved these changes
Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Puts the lint job back to green. It has been red on
mainsince 18 August, so every PR opened since has inherited a failing check.mix hex.auditreports three cowlib advisories and our ignore list covered two, so CVE-2026-43971 fails the build. There is nothing to upgrade to, cowlib 2.19.0 is the newest release on Hex and predates the advisory. Suppressing is safe because all three name functions on cowlib's header building path and nothing in our tree calls them, so each ID now carries its function in the comment.Validation steps
mix hex.auditexits 0 with all three under "Ignored advisories". Note it only reports advisories on Hex 2.3 and up. CI runsmix local.hex --forceso it gets the latest, but a local Hex 2.2.x says "No retired packages found" and passes either way. I checked against 2.5.1.mix format --check-formatted,mix credo --strict --all,mix sobelow --threshold mediumandmix deps.audit --ignore-file .mix_audit.ignoreall pass. Those are the other four checks in the lint job.Additional notes for the reviewer
No changelog entry, this is build tooling.
AI Usage
Please disclose whether you've used AI anywhere in this PR (it's cool, we just want to know!):
You can read more details in our Responsible AI Policy
Pre-submission checklist