deps: partitioned_buffer dependency update 2026-09-02 - #22
Conversation
…-> 0.40.3, telemetry 1.4.1 -> 1.4.2, usage_rules 1.2.6 -> 1.2.7
…rough EEF-CVE-2026-59249)
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour. 📝 WalkthroughWalkthroughThe project version changed from Merge Risk: ⚪ Minimal · up to This PR makes routine dependency and changelog updates without code or configuration changes, and the reported local checks pass. No actionable merge-blocking risk remains beyond normal CI completion and review. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
1 participant
Scope: routine. Updated 7 dependencies, deferred 10, excluded 4 major-magnitude dependencies as out of this PR's scope (see "Majors excluded by scope" below), closed 9 of 11 open CVEs. Bumped
partitioned_buffer0.4.3→0.4.4. The two advisories left open are onreq, a transitive dev-only dependency whose fixed version (0.6.1) is a pre-1.0 minor bump and therefore out of scope for a routine update.No
dependencieslabel exists in this repository, so this PR is unlabeled.Updated
Each dependency was unlocked and re-resolved individually (
mix deps.unlock <dep>+mix deps.get); no other lock entry moved as a side effect. Nomix.exsdependency constraint was changed.Version bump
partitioned_buffer0.4.3→0.4.4(patch bump).CHANGELOG.mdupdated.Deferred
bencheeex_docdialyxirigniter/rewritecredo,excoveralls,igniter,req,usage_rulesmakeup_elixir/makeup_erlangex_docigniterigniter/rewritebencheeMajors excluded by scope
All four are pre-1.0 packages where the available update raises the minor component, which this repository's dependency policy treats as a breaking change. All four are transitive (
usage_rules→igniter→req→finch;igniter→spitfire) and only present in the:devenvironment. Each needs a deliberate major upgrade, out of this PR's scope.CVEs
Severity labels are the ones hex prints during
mix deps.get;cvssis the vector recorded by osv.dev.resolved_bycomes from re-scanning the updatedmix.lockagainst osv.dev, not from the advisory's own "fixed" field.mint1.9.3 was chosen as the lowest release clearing all eight of its advisories (osv.dev still reports one open advisory at 1.9.2); it stays within the~> 1.6.2 or ~> 1.7requirementfinchplaces on it.Open — blocker: both
reqadvisories are fixed only fromreq 0.6.1(0.6.0still carries GHSA-655f-mp8p-96gv).0.5.17→0.6.1is a pre-1.0 minor bump, i.e. a major-magnitude change, so it is not applied here; see thereqrow under "Majors excluded by scope". Addressing it needs a deliberate major upgrade ofreq.reqis transitive and:dev-only in this repository (usage_rules→igniter→req); it is not part of the published library or of the test environment.Breaking changes adopted
None this PR.
Code changes
No code changes required — every updated dependency was a drop-in bump. The only files touched are
mix.lock,mix.exs(version attribute) andCHANGELOG.md.Migrations added
None this PR.
Config changes
None. This repository has no
config/directory and reads no application environment; none of the updated dependencies added or renamed a required configuration key..credo.exswas not changed andmix credo --strictpasses oncredo 1.7.19.Gate results
Gates are the steps of
.github/workflows/ci.yml's lint matrix row (Elixir 1.19 / OTP 28,MIX_ENV=test), run locally on Elixir 1.19.5 / OTP 28.5 (matching.tool-versions) at the untouched base commit first (baseline) and again after every commit on this branch. The CI matrix additionally runs the test suite on Elixir 1.18 / OTP 28 and Elixir 1.17 / OTP 25, which were not exercised locally — CI is the evidence for those two rows.neutral; recorded, not treated as a passVerification
Before being marked ready, this PR was independently re-checked against the rules it is supposed to follow, and all 7/7 checks pass: repo kind and version bump (a
packageblock is present, so this is a published library;0.4.3→0.4.4is a patch bump andCHANGELOG.mdgained an entry); CVE claims re-derived by re-scanning both the base and the headmix.lockagainst osv.dev, matching advisories by the union of their ids and aliases (9 cleared — 1 onhpax, 8 onmint— the 2reqadvisories still open exactly as the table above says, and none introduced); major-boundary authorization (none of the seven moved dependencies crosses it); forbidden files (onlyCHANGELOG.md,mix.exs,mix.lockchanged — no CI config, tests,.credo.exsor dialyzer ignore file); PR body completeness; self-contained content; and CI state (every resolvable check passed; the WhiteSource check reported neutral and was recorded as skipped). No CI job on this PR waits on a manual approval, so nothing was ignored for readiness and nothing was actioned.