Build log
host
chroxy 0.7.0 · fail · run chroxy-0.7.0-1790964236852
379 of 379 lines
1Resolving Hex dependencies...2Resolution completed in 0.398s3Unchanged:4 certifi 2.15.05 chrome_remote_interface 0.3.06 chroxy 0.7.07 circular_buffer 1.1.08 cowboy 2.8.0 VULNERABLE!9 GHSA-w4f7-4cxr-rv3c (MEDIUM)10 aka: CVE-2026-43966, EEF-CVE-2026-4396611 cowboy and gun affected by an HTTP Request/Response Splitting vulnerability12 https://osv.dev/vulnerability/GHSA-w4f7-4cxr-rv3c1314 EEF-CVE-2026-8466 (HIGH)15 aka: CVE-2026-8466, GHSA-jfc2-q6qh-g5x816 Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy17 https://osv.dev/vulnerability/EEF-CVE-2026-84661819 EEF-CVE-2026-65624 (MEDIUM)20 aka: CVE-2026-6562421 Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion22 https://osv.dev/vulnerability/EEF-CVE-2026-6562423 cowboy_telemetry 0.3.124 cowlib 2.9.1 VULNERABLE!25 EEF-CVE-2026-7790 (HIGH)26 aka: CVE-2026-7790, GHSA-32p9-57cr-4x6527 Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS28 https://osv.dev/vulnerability/EEF-CVE-2026-77902930 EEF-CVE-2026-43968 (MEDIUM)31 aka: CVE-2026-43968, GHSA-hv23-4qp7-8c8r32 CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/133 https://osv.dev/vulnerability/EEF-CVE-2026-439683435 EEF-CVE-2026-43970 (HIGH)36 aka: CVE-2026-43970, GHSA-84f2-rp86-235p37 Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame38 https://osv.dev/vulnerability/EEF-CVE-2026-439703940 EEF-CVE-2026-59248 (HIGH)41 aka: CVE-2026-5924842 Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS43 https://osv.dev/vulnerability/EEF-CVE-2026-592484445 EEF-CVE-2026-43969 (LOW)46 aka: CVE-2026-43969, GHSA-g2wm-735q-3f5647 Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/148 https://osv.dev/vulnerability/EEF-CVE-2026-439694950 EEF-CVE-2026-43966 (MEDIUM)51 aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c52 HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/253 https://osv.dev/vulnerability/EEF-CVE-2026-439665455 EEF-CVE-2026-43971 (MEDIUM)56 aka: CVE-2026-4397157 Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/158 https://osv.dev/vulnerability/EEF-CVE-2026-4397159 elixir_make 0.10.060 erlexec 1.10.9 RETIRED!61 (deprecated) Deprecated62 exexec 0.2.063 hackney 1.25.0 VULNERABLE!64 EEF-CVE-2026-47071 (HIGH)65 aka: CVE-2026-47071, GHSA-gp9c-pm5m-5cxr66 SOCKS5 TLS upgrade ignores caller timeout in hackney67 https://osv.dev/vulnerability/EEF-CVE-2026-470716869 EEF-CVE-2026-47076 (MEDIUM)70 aka: CVE-2026-47076, GHSA-pj7v-xfvx-wmjq71 SSRF allowlist bypass via percent-encoded host in hackney72 https://osv.dev/vulnerability/EEF-CVE-2026-470767374 EEF-CVE-2026-47069 (LOW)75 aka: CVE-2026-47069, GHSA-mp55-p8c9-rfw276 CRLF injection in cookie domain/path options in hackney77 https://osv.dev/vulnerability/EEF-CVE-2026-470697879 EEF-CVE-2026-47075 (MEDIUM)80 aka: CVE-2026-47075, GHSA-j9wq-vxxc-94wf81 CR/LF injection in query parameter in hackney82 https://osv.dev/vulnerability/EEF-CVE-2026-4707583 idna 6.1.184 interactive_cmd 0.1.485 jason 1.4.586 metrics 1.0.187 mime 1.6.088 mimerl 1.5.089 nerves 2.0.0-pre.290 nerves_discovery 0.1.591 nerves_logging 0.2.492 nerves_runtime 0.13.1393 nerves_system_bbb 2.30.294 nerves_system_br 1.34.495 nerves_system_mangopi_mq_pro 0.17.296 nerves_system_qemu_aarch64 0.4.297 nerves_system_rpi0 2.1.298 nerves_system_rpi4 2.1.299 nerves_system_rpi5 2.1.2100 nerves_system_trellis 0.5.0101 nerves_system_x86_64 1.34.2102 nerves_toolchain_aarch64_nerves_linux_gnu 15.3.1103 nerves_toolchain_armv6_nerves_linux_gnueabihf 15.3.1104 nerves_toolchain_armv7_nerves_linux_gnueabihf 15.3.1105 nerves_toolchain_riscv64_nerves_linux_gnu 15.3.1106 nerves_toolchain_x86_64_nerves_linux_musl 15.3.1107 nerves_uevent 0.1.7108 parse_trans 3.4.1109 plug 1.10.4 VULNERABLE!110 EEF-CVE-2026-8468 (HIGH)111 aka: CVE-2026-8468, GHSA-468c-vq7p-gh64112 Unbounded buffer accumulation in multipart header parsing causes denial of service in plug113 https://osv.dev/vulnerability/EEF-CVE-2026-8468114115 EEF-CVE-2026-56813 (LOW)116 aka: CVE-2026-56813, GHSA-wpmj-jh88-rpgm117 Cookie attribute injection in Plug.Conn.Cookies.encode/2118 https://osv.dev/vulnerability/EEF-CVE-2026-56813119120 EEF-CVE-2026-56814 (MEDIUM)121 aka: CVE-2026-56814, GHSA-95qv-c9g9-rm63122 Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)123 https://osv.dev/vulnerability/EEF-CVE-2026-56814124 plug_cowboy 2.4.1 VULNERABLE!125 EEF-CVE-2026-32688 (HIGH)126 aka: CVE-2026-32688, GHSA-q8x4-x7mp-5vg2127 Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy128 https://osv.dev/vulnerability/EEF-CVE-2026-32688129 plug_crypto 1.2.5130 poison 3.1.0131 property_table 0.3.4132 ranch 1.7.1133 ring_logger 0.11.7134 ssl_verify_fun 1.1.7135 tablet 0.3.3136 telemetry 0.4.3137 toolshed 0.5.0138 uboot_env 1.0.2139 unicode_util_compat 0.7.1140 websockex 0.4.3141Found retired packages, see above for details142Found packages with security advisories, see above for details143All dependencies have been fetched144 warning: String.strip/1 is deprecated. Use String.trim/1 instead145 │146 4 │ @version File.read!("VERSION") |> String.strip147 │ ~148 │149 └─ /work/proj/deps/poison/mix.exs:4:44: Poison.Mixfile (module)150151 warning: using single-quoted strings to represent charlists is deprecated.152 Use ~c"" if you indeed want a charlist or use "" instead.153 You may run "mix format --migrate" to change all single-quoted154 strings to use the ~c sigil and fix this warning.155 │156 21 │ defp elixirc_paths(:test), do: ['lib', 'test/support']157 │ ~158 │159 └─ /work/proj/deps/websockex/mix.exs:21:35160161 warning: using single-quoted strings to represent charlists is deprecated.162 Use ~c"" if you indeed want a charlist or use "" instead.163 You may run "mix format --migrate" to change all single-quoted164 strings to use the ~c sigil and fix this warning.165 │166 21 │ defp elixirc_paths(:test), do: ['lib', 'test/support']167 │ ~168 │169 └─ /work/proj/deps/websockex/mix.exs:21:42170171 warning: using single-quoted strings to represent charlists is deprecated.172 Use ~c"" if you indeed want a charlist or use "" instead.173 You may run "mix format --migrate" to change all single-quoted174 strings to use the ~c sigil and fix this warning.175 │176 22 │ defp elixirc_paths(_), do: ['lib']177 │ ~178 │179 └─ /work/proj/deps/websockex/mix.exs:22:31180181==> mime182Compiling 2 files (.ex)183Generated mime app184==> poison185Compiling 4 files (.ex)186 warning: using single-quoted strings to represent charlists is deprecated.187 Use ~c"" if you indeed want a charlist or use "" instead.188 You may run "mix format --migrate" to change all single-quoted189 strings to use the ~c sigil and fix this warning.190 │191 93 │ for {char, seq} <- Enum.zip('"\\\n\t\r\f\b', '"\\ntrfb') do192 │ ~193 │194 └─ lib/poison/encoder.ex:93:31195196 warning: using single-quoted strings to represent charlists is deprecated.197 Use ~c"" if you indeed want a charlist or use "" instead.198 You may run "mix format --migrate" to change all single-quoted199 strings to use the ~c sigil and fix this warning.200 │201 93 │ for {char, seq} <- Enum.zip('"\\\n\t\r\f\b', '"\\ntrfb') do202 │ ~203 │204 └─ lib/poison/encoder.ex:93:48205206 warning: using single-quoted strings to represent charlists is deprecated.207 Use ~c"" if you indeed want a charlist or use "" instead.208 You may run "mix format --migrate" to change all single-quoted209 strings to use the ~c sigil and fix this warning.210 │211 139 │ defp chunk_size(<<char>> <> _, _mode, acc) when char <= 0x1F or char in '"\\' do212 │ ~213 │214 └─ lib/poison/encoder.ex:139:75215216 warning: using single-quoted strings to represent charlists is deprecated.217 Use ~c"" if you indeed want a charlist or use "" instead.218 You may run "mix format --migrate" to change all single-quoted219 strings to use the ~c sigil and fix this warning.220 │221 77 │ defp value(<<char, _ :: binary>> = string, pos, _keys) when char in '-0123456789' do222 │ ~223 │224 └─ lib/poison/parser.ex:77:71225226 warning: using single-quoted strings to represent charlists is deprecated.227 Use ~c"" if you indeed want a charlist or use "" instead.228 You may run "mix format --migrate" to change all single-quoted229 strings to use the ~c sigil and fix this warning.230 │231 155 │ defp number_int(<<char, _ :: binary>> = string, pos, acc) when char in '123456789' do232 │ ~233 │234 └─ lib/poison/parser.ex:155:74235236 warning: using single-quoted strings to represent charlists is deprecated.237 Use ~c"" if you indeed want a charlist or use "" instead.238 You may run "mix format --migrate" to change all single-quoted239 strings to use the ~c sigil and fix this warning.240 │241 171 │ defp number_exp(<<e>> <> rest, frac, pos, acc) when e in 'eE' do242 │ ~243 │244 └─ lib/poison/parser.ex:171:60245246 warning: using single-quoted strings to represent charlists is deprecated.247 Use ~c"" if you indeed want a charlist or use "" instead.248 You may run "mix format --migrate" to change all single-quoted249 strings to use the ~c sigil and fix this warning.250 │251 197 │ defp number_digits(<<char>> <> rest = string, pos) when char in '0123456789' do252 │ ~253 │254 └─ lib/poison/parser.ex:197:67255256 warning: using single-quoted strings to represent charlists is deprecated.257 Use ~c"" if you indeed want a charlist or use "" instead.258 You may run "mix format --migrate" to change all single-quoted259 strings to use the ~c sigil and fix this warning.260 │261 205 │ defp number_digits_count(<<char>> <> rest, acc) when char in '0123456789' do262 │ ~263 │264 └─ lib/poison/parser.ex:205:64265266 warning: using single-quoted strings to represent charlists is deprecated.267 Use ~c"" if you indeed want a charlist or use "" instead.268 You may run "mix format --migrate" to change all single-quoted269 strings to use the ~c sigil and fix this warning.270 │271 229 │ for {seq, char} <- Enum.zip('"\\ntr/fb', '"\\\n\t\r/\f\b') do272 │ ~273 │274 └─ lib/poison/parser.ex:229:31275276 warning: using single-quoted strings to represent charlists is deprecated.277 Use ~c"" if you indeed want a charlist or use "" instead.278 You may run "mix format --migrate" to change all single-quoted279 strings to use the ~c sigil and fix this warning.280 │281 229 │ for {seq, char} <- Enum.zip('"\\ntr/fb', '"\\\n\t\r/\f\b') do282 │ ~283 │284 └─ lib/poison/parser.ex:229:44285286 warning: using single-quoted strings to represent charlists is deprecated.287 Use ~c"" if you indeed want a charlist or use "" instead.288 You may run "mix format --migrate" to change all single-quoted289 strings to use the ~c sigil and fix this warning.290 │291 239 │ when a1 in 'dD' and a2 in 'dD'292 │ ~293 │294 └─ lib/poison/parser.ex:239:16295296 warning: using single-quoted strings to represent charlists is deprecated.297 Use ~c"" if you indeed want a charlist or use "" instead.298 You may run "mix format --migrate" to change all single-quoted299 strings to use the ~c sigil and fix this warning.300 │301 239 │ when a1 in 'dD' and a2 in 'dD'302 │ ~303 │304 └─ lib/poison/parser.ex:239:31305306 warning: using single-quoted strings to represent charlists is deprecated.307 Use ~c"" if you indeed want a charlist or use "" instead.308 You may run "mix format --migrate" to change all single-quoted309 strings to use the ~c sigil and fix this warning.310 │311 240 │ and (b1 in '89abAB')312 │ ~313 │314 └─ lib/poison/parser.ex:240:16315316 warning: using single-quoted strings to represent charlists is deprecated.317 Use ~c"" if you indeed want a charlist or use "" instead.318 You may run "mix format --migrate" to change all single-quoted319 strings to use the ~c sigil and fix this warning.320 │321 274 │ defp skip_whitespace(<<char>> <> rest, pos) when char in '\s\n\t\r' do322 │ ~323 │324 └─ lib/poison/parser.ex:274:60325326 warning: Application.get_env/2 is discouraged in the module body, use Application.compile_env/3 instead327 │328 22 │ if Application.get_env(:poison, :native) do329 │ ~330 │331 └─ lib/poison/parser.ex:22:18: Poison.Parser (module)332333 warning: use Bitwise is deprecated. import Bitwise instead334 │335 26 │ use Bitwise336 │ ~~~~~~~~~~~337 │338 └─ lib/poison/parser.ex:26: Poison.Parser (module)339340 warning: the variable "count" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator341 │342 199 │ <<digits :: binary-size(count), rest :: binary>> = string343 │ ~344 │345 └─ lib/poison/parser.ex:199:29: Poison.Parser.number_digits/2346347 warning: the variable "count" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator348 │349 225 │ <<chunk :: binary-size(count), rest :: binary>> = string350 │ ~351 │352 └─ lib/poison/parser.ex:225:28: Poison.Parser.string_continue/3353354 warning: use Bitwise is deprecated. import Bitwise instead355 │356 83 │ use Bitwise357 │ ~~~~~~~~~~~358 │359 └─ lib/poison/encoder.ex:83: Poison.Encoder.BitString (module)360361 warning: the variable "size" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator362 │363 135 │ <<chunk :: binary-size(size), rest :: binary>> = string364 │ ~365 │366 └─ lib/poison/encoder.ex:135:28: Poison.Encoder.BitString.escape/2367368 warning: Integer.to_char_list/2 is deprecated. Use Integer.to_charlist/2 instead369 │370 173 │ case Integer.to_char_list(char, 16) do371 │ ~372 │373 └─ lib/poison/encoder.ex:173:18: Poison.Encoder.BitString.seq/1374375Generated poison app376==> websockex377could not compile dependency :websockex, "mix compile" failed. Errors may have been logged above. You can recompile this dependency with "mix deps.compile websockex --force", update it with "mix deps.update websockex" or clean it with "mix deps.clean websockex"378==> nerves_compatibility_test379** (Mix) :elixirc_paths should be a list of string paths, got: [~c"lib"]