Post

@peterullrich.com

🚨 Update hackney 🚨 A **bunch** of vulnerabilities I reported in hackney were just disclosed. Please upgrade to 4.0.1 ASAP. I know this is gonna start dependency hell so please take some time for this. Please RT for reach. #ElixirLang cna.erlef.org/cves/

cna.erlef.orgList of Issued CVE’sThis project handles the CVE Numbering Authority (CNA) for the Erlang Ecosystem Foundation (EEF).

25/5/26, 3:09 pm23 reposts30 likes

Yevhenii Kurtov

@yevhenii.kurtov.pro

Thank you! It's a shame we can't have something like socket.dev for Elixir. It would never be profitable :(

socket.devsocket.dev

Philipp 🐘 keila.io

@pentacent.bsky.social

Thanks for sharing this! It seems mix hex.audit only warns if packages have been retired and not if there's a known vulnerability 🤔

Philipp 🐘 keila.io

@pentacent.bsky.social

Ah, looks like @maennchen.dev added this two weeks ago. Neat! github.com/hexpm/hex/pu...

github.comWarn on installation of vulnerable packages by maennchen · Pull Request #1150 · hexpm/hexclean retired vulnerable retired & vulnerable

@peterullrich.com

@maennchen.dev release when?

Jonatan Männchen

Soon, Eric is working on some tooling around the feature before release.

Wow! That is quite a collection

Dr. Christian Geuer-Pollmann

@christian.geuer-pollmann.de

Peter becoming (a) Mythos

@peterullrich.com