Bump mint to 1.10.0 to clear two advisories - #5117
Merged
Merged
Conversation
Security Review ✅
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #5117 +/- ##
=======================================
- Coverage 90.7% 90.7% -0.0%
=======================================
Files 417 417
Lines 20347 20347
=======================================
- Hits 18459 18453 -6
- Misses 1888 1894 +6 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
mint 1.9.3 is affected by EEF-CVE-2026-82728 (high), unbounded HTTP/1 status-line and chunk-extension buffering, and EEF-CVE-2026-82729 (medium), quadratic chunk-size parsing. Both are denial of service, both fixed in 1.10.0. Mint is our HTTP client, so both are reachable from a response rather than from a request into Lightning; the exposure is the outbound calls Lightning makes. `mix hex.audit` raises these and is currently red on main, so lint fails on every branch. `mix deps.audit` does not: its advisory mirror has not picked them up yet. Lock file only. mix.exs already requires `~> 1.0` and nothing else moved. The bump also moves PinnedAdapter's dialyzer warnings. mint 1.10.0 widens `Mint.Core.Util.hostname/2` from `String.t()` to `Types.address()`, so the IP-pinned connect no longer looks impossible and the `:call` plus its `:pattern_match` and `:unused_fun` cascade stop firing. What surfaces instead is an opacity complaint that was always there: `Mint.HTTP.t()` is a plain union of types that are opaque in their own modules. So those three filters are replaced by one for `:call_with_opaque`, and the `:no_return` that follows is scoped to `exchange/4` with a `@dialyzer` attribute rather than filtered file-wide, so the category keeps reporting for the rest of that module.
elias-ba
force-pushed
the
fix/mint-advisories
branch
from
September 4, 2026 23:32
7579515 to
6d87c8b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR bumps
mintto 1.10.0. 1.9.3 is affected by EEF-CVE-2026-82728 (high) and EEF-CVE-2026-82729 (medium), both denial of service in Mint's HTTP/1 parser.mix hex.auditis red on main's head, so lint fails on every branch.Lock file only. It does move
PinnedAdapter's dialyzer warnings, because 1.10.0 widensMint.Core.Util.hostname/2and the pinned connect no longer looks impossible, so the three filters that file carried are replaced by one for:call_with_opaqueplus a@dialyzerattribute onexchange/4.Validation steps
grep '"mint"' mix.lockshows 1.10.0.mix dialyzerpasses. With.dialyzer_ignore.exsemptied,PinnedAdapteremits exactly the four warnings covered here.mix test test/lightning/auth_providers/. 34 tests, no failures.Additional notes for the reviewer
:no_returnis scoped toexchange/4rather than filtered file-wide, so it still reports fortransport_opts/3, which is what forcesverify: :verify_peer.mix deps.auditpasses either way; its mirror does not carry these yet. Onlyhex.auditcatches them.AI Usage
Pre-submission checklist
/reviewwith Claude Code)
(e.g.,
:owner,:admin,:editor,:viewer)