Relax tesla constraint to ~> 1.4#1
Merged
Merged
Conversation
The previous `>= 1.4.0 and <= 1.12.0` cap pinned downstream consumers to tesla 1.12.0, which is affected by several security advisories (auth header leak on redirect, atom exhaustion, decompression bomb, etc. — first patched in tesla 1.18.3). `~> 1.4` (i.e. `>= 1.4.0 and < 2.0.0`) keeps excontainers' real lower bound and lets consumers pick up 1.18.3+ and any future 1.x, while still guarding against a breaking tesla 2.0 (excontainers uses the soft- deprecated `use Tesla.Builder`, which 2.0 will remove). Verified: excontainers compiles cleanly against tesla 1.20.0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The current
{:tesla, ">= 1.4.0 and <= 1.12.0"}cap forces every downstream consumer to stay on tesla 1.12.0, which is flagged bymix_auditfor several advisories (first patched in 1.18.3), including high-severity ones:GHSA-9m9w-gxf7-rh8m— Authorization header leaks on cross-origin redirect (high)GHSA-h74c-q9j7-mpcm— atom exhaustion via untrusted URL scheme (high)GHSA-mc85-72gr-vm9f— decompression bomb on response body (high)GHSA-28jh-g32x-v9v4,GHSA-q7jx-v53g-848w— multipart smuggling / CRLF injection (low)This is blocking dependency-audit CI in
qdentity/mindfields-phx, which pulls excontainers (test-only) transitively.Change
{:tesla, "~> 1.4"}→>= 1.4.0 and < 2.0.0. Keeps the real lower bound, lifts the artificial<= 1.12.0cap so consumers can move to 1.18.3+ and any future 1.x without needing another bump here, while still guarding against a breaking tesla 2.0 — excontainers uses the soft-deprecateduse Tesla.Builder, which Tesla 2.0 will remove.Verification
mix deps.update teslaresolves to tesla 1.20.0 andmix compilebuilds excontainers cleanly against it (only the expecteduse Tesla.Buildersoft-deprecation warning). Docker-backed integration tests were not run in this environment.