Build log
nerves_system_x86_64
ash_sanity 0.3.0 · fail · run ash_sanity-0.3.0-1789853776155
292 of 292 lines
1Resolving Hex dependencies...2Resolution completed in 1.965s3Unchanged:4 ash 2.21.15 VULNERABLE!5 EEF-CVE-2026-82739 (LOW)6 aka: CVE-2026-82739, GHSA-66cg-vj5m-8w7v7 Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error8 https://osv.dev/vulnerability/EEF-CVE-2026-82739910 EEF-CVE-2025-48043 (HIGH)11 aka: CVE-2025-48043, GHSA-7r7f-9xpj-jmr712 Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization13 https://osv.dev/vulnerability/EEF-CVE-2025-480431415 GHSA-jjf9-w5vj-r6vp (HIGH)16 aka: CVE-2026-3459317 Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash18 https://osv.dev/vulnerability/GHSA-jjf9-w5vj-r6vp1920 EEF-CVE-2025-48042 (HIGH)21 aka: CVE-2025-48042, GHSA-jj4j-x5ww-cwh922 Before action hooks may execute in certain scenarios despite a request being forbidden23 https://osv.dev/vulnerability/EEF-CVE-2025-480422425 EEF-CVE-2026-67579 (HIGH)26 aka: CVE-2026-67579, GHSA-3gq3-9xm3-c8v327 Filter expression injection via forged keyset pagination cursor in Ash28 https://osv.dev/vulnerability/EEF-CVE-2026-675792930 EEF-CVE-2026-82736 (LOW)31 aka: CVE-2026-82736, GHSA-gg9w-7593-hxg932 Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass33 https://osv.dev/vulnerability/EEF-CVE-2026-827363435 EEF-CVE-2026-86338 (MEDIUM)36 aka: CVE-2026-86338, GHSA-7qr8-wrvq-566q37 Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle38 https://osv.dev/vulnerability/EEF-CVE-2026-863383940 EEF-CVE-2026-82734 (LOW)41 aka: CVE-2026-82734, GHSA-mvvh-q33h-q62v42 Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal43 https://osv.dev/vulnerability/EEF-CVE-2026-827344445 EEF-CVE-2026-69659 (MEDIUM)46 aka: CVE-2026-69659, GHSA-j35q-v8h8-7mwq47 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset48 https://osv.dev/vulnerability/EEF-CVE-2026-696594950 EEF-CVE-2026-82752 (MEDIUM)51 aka: CVE-2026-82752, GHSA-cwjv-574p-59f652 Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length53 https://osv.dev/vulnerability/EEF-CVE-2026-827525455 EEF-CVE-2026-82741 (LOW)56 aka: CVE-2026-82741, GHSA-2mmm-gc86-7jgg57 Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion58 https://osv.dev/vulnerability/EEF-CVE-2026-827415960 EEF-CVE-2026-70395 (LOW)61 aka: CVE-2026-70395, GHSA-vvp6-3wv6-833j62 Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash63 https://osv.dev/vulnerability/EEF-CVE-2026-703956465 EEF-CVE-2026-82742 (MEDIUM)66 aka: CVE-2026-82742, GHSA-mgwj-c69v-6f8367 Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory68 https://osv.dev/vulnerability/EEF-CVE-2026-827426970 EEF-CVE-2026-82745 (MEDIUM)71 aka: CVE-2026-82745, GHSA-92x7-q3h5-wf8872 ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness73 https://osv.dev/vulnerability/EEF-CVE-2026-827457475 EEF-CVE-2026-82743 (LOW)76 aka: CVE-2026-82743, GHSA-33wq-x3q2-c92h77 Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads78 https://osv.dev/vulnerability/EEF-CVE-2026-827437980 EEF-CVE-2026-82735 (MEDIUM)81 aka: CVE-2026-82735, GHSA-mq7g-pffw-m8xh82 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service83 https://osv.dev/vulnerability/EEF-CVE-2026-827358485 EEF-CVE-2026-82740 (LOW)86 aka: CVE-2026-82740, GHSA-v29m-p28g-w5fc87 Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs88 https://osv.dev/vulnerability/EEF-CVE-2026-827408990 EEF-CVE-2026-82737 (MEDIUM)91 aka: CVE-2026-82737, GHSA-68q3-w4w3-2gfv92 Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads93 https://osv.dev/vulnerability/EEF-CVE-2026-8273794 ash_sanity 0.3.095 circular_buffer 1.1.096 comparable 1.0.097 decimal 2.4.1 VULNERABLE!98 EEF-CVE-2026-32686 (MEDIUM)99 aka: CVE-2026-32686, GHSA-rhv4-8758-jx7v100 Unbounded exponent in decimal enables unauthenticated DoS101 https://osv.dev/vulnerability/EEF-CVE-2026-32686102 earmark 1.4.49 RETIRED! VULNERABLE!103 (deprecated) Earmark is no longer maintained. Migrate to a replacement, for example MDEx (https://hex.pm/packages/mdex).104105 EEF-CVE-2026-48591 (MEDIUM)106 aka: CVE-2026-48591, GHSA-52mm-h59v-f3c7107 Stored XSS via unescaped HTML attribute values in earmark108 https://osv.dev/vulnerability/EEF-CVE-2026-48591109 ecto 3.13.6110 elixir_make 0.10.0111 ets 0.9.0112 finch 0.23.0113 hpax 1.0.4114 interactive_cmd 0.1.4115 jason 1.4.5116 libgraph 0.16.0117 mime 2.0.7118 mint 1.10.1119 nerves 1.15.0120 nerves_discovery 0.1.5121 nerves_logging 0.2.4122 nerves_runtime 0.13.13123 nerves_system_bbb 2.30.2124 nerves_system_br 1.34.4125 nerves_system_mangopi_mq_pro 0.17.2126 nerves_system_qemu_aarch64 0.4.2127 nerves_system_rpi 2.1.2128 nerves_system_rpi0 2.1.2129 nerves_system_rpi0_2 2.1.2130 nerves_system_rpi2 2.1.2131 nerves_system_rpi3 2.1.2132 nerves_system_rpi4 2.1.2133 nerves_system_rpi5 2.1.2134 nerves_system_x86_64 1.34.2135 nerves_toolchain_aarch64_nerves_linux_gnu 15.3.1136 nerves_toolchain_armv6_nerves_linux_gnueabihf 15.3.1137 nerves_toolchain_armv7_nerves_linux_gnueabihf 15.3.1138 nerves_toolchain_riscv64_nerves_linux_gnu 15.3.1139 nerves_toolchain_x86_64_nerves_linux_musl 15.3.1140 nerves_uevent 0.1.7141 nimble_options 1.1.1142 nimble_pool 1.1.0143 picosat_elixir 0.2.3144 property_table 0.3.4145 reactor 0.7.0146 ring_logger 0.11.7147 sanity 1.3.0148 shoehorn 0.9.3149 sourceror 1.12.3150 spark 1.1.55151 stream_data 0.6.0152 tablet 0.3.3153 telemetry 1.4.2154 toolshed 0.5.0155 typable 0.3.0156 uboot_env 1.0.2157* Getting ash_sanity (Hex package)158* Getting nerves (Hex package)159* Getting shoehorn (Hex package)160* Getting ring_logger (Hex package)161* Getting toolshed (Hex package)162* Getting nerves_runtime (Hex package)163* Getting nerves_system_bbb (Hex package)164* Getting nerves_system_mangopi_mq_pro (Hex package)165* Getting nerves_system_qemu_aarch64 (Hex package)166* Getting nerves_system_rpi (Hex package)167* Getting nerves_system_rpi0 (Hex package)168* Getting nerves_system_rpi0_2 (Hex package)169* Getting nerves_system_rpi2 (Hex package)170* Getting nerves_system_rpi3 (Hex package)171* Getting nerves_system_rpi4 (Hex package)172* Getting nerves_system_rpi5 (Hex package)173* Getting nerves_system_x86_64 (Hex package)174* Getting nerves_system_br (Hex package)175* Getting nerves_toolchain_x86_64_nerves_linux_musl (Hex package)176* Getting nerves_toolchain_aarch64_nerves_linux_gnu (Hex package)177* Getting nerves_toolchain_armv7_nerves_linux_gnueabihf (Hex package)178* Getting nerves_toolchain_armv6_nerves_linux_gnueabihf (Hex package)179* Getting nerves_toolchain_riscv64_nerves_linux_gnu (Hex package)180* Getting nerves_logging (Hex package)181* Getting nerves_uevent (Hex package)182* Getting uboot_env (Hex package)183* Getting elixir_make (Hex package)184* Getting property_table (Hex package)185* Getting circular_buffer (Hex package)186* Getting interactive_cmd (Hex package)187* Getting jason (Hex package)188* Getting nerves_discovery (Hex package)189* Getting tablet (Hex package)190* Getting ash (Hex package)191* Getting sanity (Hex package)192* Getting finch (Hex package)193* Getting nimble_options (Hex package)194* Getting mime (Hex package)195* Getting mint (Hex package)196* Getting nimble_pool (Hex package)197* Getting telemetry (Hex package)198* Getting hpax (Hex package)199* Getting comparable (Hex package)200* Getting decimal (Hex package)201* Getting earmark (Hex package)202* Getting ecto (Hex package)203* Getting ets (Hex package)204* Getting picosat_elixir (Hex package)205* Getting reactor (Hex package)206* Getting spark (Hex package)207* Getting stream_data (Hex package)208* Getting sourceror (Hex package)209* Getting libgraph (Hex package)210* Getting typable (Hex package)211Found retired packages, see above for details212Found packages with security advisories, see above for details213You have added/upgraded packages you could sponsor, run `mix hex.sponsor` to learn more214==> tablet215Compiling 2 files (.ex)216Generated tablet app217==> elixir_make218Compiling 8 files (.ex)219Generated elixir_make app220==> nerves_discovery221Compiling 5 files (.ex)222Generated nerves_discovery app223==> decimal224Compiling 4 files (.ex)225 warning: this clause of defp check_dbl_min_max/1 is never used (or it will always fail/warn when invoked)226 │227 2842 │ defp check_dbl_min_max(%Decimal{coef: :inf} = infinity), do: infinity228 │ ~229 │230 └─ lib/decimal.ex:2842:8: Decimal.check_dbl_min_max/1231232Generated decimal app233==> jason234Compiling 10 files (.ex)235Compiling lib/decoder.ex (it's taking more than 10s)236Generated jason app237==> interactive_cmd238Compiling 1 file (.ex)239Generated interactive_cmd app240==> nerves241HOST_CC port.o242HOST_LD port243Compiling 55 files (.ex)244Generated nerves app245==> nerves_compatibility_test246247Nerves environment248 MIX_TARGET: x86_64249 MIX_ENV: prod250251Checking for prebuilt Nerves artifacts...252 Found nerves_system_x86_64 in cache253 /home/nerves/.nerves/artifacts/nerves_system_x86_64-portable-1.34.2254 Found nerves_toolchain_x86_64_nerves_linux_musl in cache255 /home/nerves/.nerves/artifacts/nerves_toolchain_x86_64_nerves_linux_musl-linux_x86_64-15.3.1256==> decimal257 warning: this clause of defp check_dbl_min_max/1 is never used (or it will always fail/warn when invoked)258 │259 2842 │ defp check_dbl_min_max(%Decimal{coef: :inf} = infinity), do: infinity260 │ ~261 │262 └─ (decimal 2.4.1) lib/decimal.ex:2842:8: Decimal.check_dbl_min_max/1263264==> nerves265==> nerves_compatibility_test266267Nerves environment268 MIX_TARGET: x86_64269 MIX_ENV: prod270271==> mint272Compiling 1 file (.erl)273Compiling 20 files (.ex)274Generated mint app275==> picosat_elixir276/home/nerves/.nerves/artifacts/nerves_toolchain_x86_64_nerves_linux_musl-linux_x86_64-15.3.1/bin/x86_64-nerves-linux-musl-gcc -std=c99 -finline-functions -Wall -O3 -DNDEBUG -fPIC -I /home/nerves/.nerves/artifacts/nerves_system_x86_64-portable-1.34.2/staging/usr/lib/erlang/erts-17.0.6/include -o /work/proj/deps_x86_64/picosat_elixir/priv/picosat.o -c /work/proj/deps_x86_64/picosat_elixir/c_src/picosat.c277/home/nerves/.nerves/artifacts/nerves_toolchain_x86_64_nerves_linux_musl-linux_x86_64-15.3.1/bin/x86_64-nerves-linux-musl-gcc -std=c99 -finline-functions -Wall -O3 -DNDEBUG -fPIC -I /home/nerves/.nerves/artifacts/nerves_system_x86_64-portable-1.34.2/staging/usr/lib/erlang/erts-17.0.6/include -o /work/proj/deps_x86_64/picosat_elixir/priv/picosat_nif.o -c /work/proj/deps_x86_64/picosat_elixir/c_src/picosat_nif.c278/work/proj/deps_x86_64/picosat_elixir/c_src/picosat.c:8150:10: fatal error: sys/unistd.h: No such file or directory279 8150 | #include <sys/unistd.h>280 | ^~~~~~~~~~~~~~281compilation terminated.282make: *** [Makefile:49: /work/proj/deps_x86_64/picosat_elixir/priv/picosat.o] Error 1283make: *** Waiting for unfinished jobs....284could not compile dependency :picosat_elixir, "mix compile" failed. Errors may have been logged above. You can recompile this dependency with "mix deps.compile picosat_elixir --force", update it with "mix deps.update picosat_elixir" or clean it with "mix deps.clean picosat_elixir"285==> nerves_compatibility_test286** (Mix) Could not compile with "make" (exit status: 2).287You need to have gcc and make installed. If you are using288Ubuntu or any other Debian-based system, install the packages289"build-essential". Also install "erlang-dev" package if not290included in your Erlang/OTP version. If you're on Fedora, run291"dnf group install 'Development Tools'".292