Post

@peterullrich.com

🚨 Update hackney 🚨 A **bunch** of vulnerabilities I reported in hackney were just disclosed. Please upgrade to 4.0.1 ASAP. I know this is gonna start dependency hell so please take some time for this. Please RT for reach. #ElixirLang cna.erlef.org/cves/

cna.erlef.orgList of Issued CVE’sThis project handles the CVE Numbering Authority (CNA) for the Erlang Ecosystem Foundation (EEF).

Philipp 🐘 keila.io

@pentacent.bsky.social

Thanks for sharing this! It seems mix hex.audit only warns if packages have been retired and not if there's a known vulnerability 🤔

Philipp 🐘 keila.io

@pentacent.bsky.social

Ah, looks like @maennchen.dev added this two weeks ago. Neat! github.com/hexpm/hex/pu...

github.comWarn on installation of vulnerable packages by maennchen · Pull Request #1150 · hexpm/hexclean retired vulnerable retired & vulnerable

@peterullrich.com

@maennchen.dev release when?

Jonatan Männchen

Soon, Eric is working on some tooling around the feature before release.

25/5/26, 9:57 pm0 reposts3 likes

No replies yet.