From 59d4c7297fececd564c5b246242a5cc55caabf37 Mon Sep 17 00:00:00 2001 From: "Tj (bougyman) Vanderpoel" Date: Wed, 14 Oct 2026 13:56:33 -0400 Subject: [PATCH] fix(workaround): exclude hex_core 0.20.0 - EEF-CVE-2026-96596 (MEDIUM) so we can still release while it is being fixed --- app/mix.exs | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/app/mix.exs b/app/mix.exs index d9743be..5983638 100644 --- a/app/mix.exs +++ b/app/mix.exs @@ -16,7 +16,16 @@ defmodule LinearCli.MixProject do deps: deps(), consolidate_protocols: Mix.env() != :dev, usage_rules: usage_rules(), - releases: releases() + releases: releases(), + hex: [ + # EEF-CVE-2026-96596: hex_core's bundled erl_tar loops forever on a + # crafted GNU sparse tar member. No fixed hex_core release exists yet + # (0.20.0 is the latest and is affected). hex_core is dev-only + # (`runtime: false`, pulled in for sbom), never ships in the release, + # and we never extract untrusted tarballs with it. Remove this entry + # once a patched hex_core is out. + ignore_advisories: ["EEF-CVE-2026-96596"] + ] ] end