nerves_system_trellis

1Resolving Hex dependencies...2Resolution completed in 0.362s3Unchanged:4  certifi 2.15.05  circular_buffer 1.1.06  cookie 0.1.27  cowboy 2.19.08  cowboy_telemetry 0.4.09  cowlib 2.20.0 VULNERABLE!10    EEF-CVE-2026-43966 (MEDIUM)11    aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c12    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/213    https://osv.dev/vulnerability/EEF-CVE-2026-439661415    EEF-CVE-2026-43969 (LOW)16    aka: CVE-2026-43969, GHSA-g2wm-735q-3f5617    Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/118    https://osv.dev/vulnerability/EEF-CVE-2026-4396919  db_connection 2.10.220  decimal 1.9.0 VULNERABLE!21    EEF-CVE-2026-32686 (MEDIUM)22    aka: CVE-2026-32686, GHSA-rhv4-8758-jx7v23    Unbounded exponent in decimal enables unauthenticated DoS24    https://osv.dev/vulnerability/EEF-CVE-2026-3268625  ecto 3.10.326  ecto_sql 3.10.227  elixir_make 0.10.028  ex_gram 0.71.029  ffmpex 0.6.030  floki 0.22.031  fluminus 1.4.332  fluminus_bot 0.1.033  hackney 1.25.0 VULNERABLE!34    EEF-CVE-2026-47071 (HIGH)35    aka: CVE-2026-47071, GHSA-gp9c-pm5m-5cxr36    SOCKS5 TLS upgrade ignores caller timeout in hackney37    https://osv.dev/vulnerability/EEF-CVE-2026-470713839    EEF-CVE-2026-47076 (MEDIUM)40    aka: CVE-2026-47076, GHSA-pj7v-xfvx-wmjq41    SSRF allowlist bypass via percent-encoded host in hackney42    https://osv.dev/vulnerability/EEF-CVE-2026-470764344    EEF-CVE-2026-47069 (LOW)45    aka: CVE-2026-47069, GHSA-mp55-p8c9-rfw246    CRLF injection in cookie domain/path options in hackney47    https://osv.dev/vulnerability/EEF-CVE-2026-470694849    EEF-CVE-2026-47075 (MEDIUM)50    aka: CVE-2026-47075, GHSA-j9wq-vxxc-94wf51    CR/LF injection in query parameter in hackney52    https://osv.dev/vulnerability/EEF-CVE-2026-4707553  html_entities 0.4.054  html_sanitize_ex 1.3.0 VULNERABLE!55    EEF-CVE-2026-68749 (HIGH)56    aka: CVE-2026-68749, GHSA-4cx2-987x-rr2x57    Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service58    https://osv.dev/vulnerability/EEF-CVE-2026-687495960    EEF-CVE-2026-66370 (MEDIUM)61    aka: CVE-2026-66370, GHSA-w3f9-jjhw-wwvq62    html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking63    https://osv.dev/vulnerability/EEF-CVE-2026-663706465    EEF-CVE-2026-66829 (LOW)66    aka: CVE-2026-66829, GHSA-2c6f-3j54-xpcr67    html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection68    https://osv.dev/vulnerability/EEF-CVE-2026-668296970    EEF-CVE-2026-66843 (LOW)71    aka: CVE-2026-66843, GHSA-xmm9-jc22-rcgj72    html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding73    https://osv.dev/vulnerability/EEF-CVE-2026-668437475    EEF-CVE-2026-68747 (LOW)76    aka: CVE-2026-68747, GHSA-87v2-pfhj-r5x777    CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input78    https://osv.dev/vulnerability/EEF-CVE-2026-687477980    EEF-CVE-2026-68750 (HIGH)81    aka: CVE-2026-68750, GHSA-463q-p2fr-mh9p82    Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service83    https://osv.dev/vulnerability/EEF-CVE-2026-6875084  httpoison 1.8.285  idna 6.1.186  interactive_cmd 0.1.487  jason 1.1.288  metrics 1.0.189  mime 2.0.790  mimerl 1.5.091  mochiweb 2.22.092  nerves 2.0.0-pre.293  nerves_discovery 0.1.594  nerves_logging 0.2.495  nerves_runtime 0.13.1396  nerves_system_bbb 2.30.297  nerves_system_br 1.34.498  nerves_system_mangopi_mq_pro 0.17.299  nerves_system_qemu_aarch64 0.4.2100  nerves_system_rpi0 2.1.2101  nerves_system_rpi4 2.1.2102  nerves_system_rpi5 2.1.2103  nerves_system_trellis 0.5.0104  nerves_system_x86_64 1.34.2105  nerves_toolchain_aarch64_nerves_linux_gnu 15.3.1106  nerves_toolchain_armv6_nerves_linux_gnueabihf 15.3.1107  nerves_toolchain_armv7_nerves_linux_gnueabihf 15.3.1108  nerves_toolchain_riscv64_nerves_linux_gnu 15.3.1109  nerves_toolchain_x86_64_nerves_linux_musl 15.3.1110  nerves_uevent 0.1.7111  nimble_ownership 1.0.2112  parse_trans 3.4.1113  plug 1.20.3114  plug_cowboy 2.9.0115  plug_crypto 2.2.0116  postgrex 0.17.5 VULNERABLE!117    EEF-CVE-2026-32687 (HIGH)118    aka: CVE-2026-32687, GHSA-r73h-97w8-m54h119    SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3120    https://osv.dev/vulnerability/EEF-CVE-2026-32687121122    EEF-CVE-2026-58225 (LOW)123    aka: CVE-2026-58225, GHSA-4mw9-4qgj-m97w124    SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service125    https://osv.dev/vulnerability/EEF-CVE-2026-58225126  property_table 0.3.4127  ranch 2.3.0128  ring_logger 0.11.7129  ssl_verify_fun 1.1.7130  tablet 0.3.3131  telemetry 1.4.2132  toolshed 0.5.0133  uboot_env 1.0.2134  unicode_util_compat 0.7.1135* Getting fluminus_bot (Hex package)136* Getting nerves (Hex package)137* Getting ring_logger (Hex package)138* Getting toolshed (Hex package)139* Getting nerves_runtime (Hex package)140* Getting nerves_system_bbb (Hex package)141* Getting nerves_system_mangopi_mq_pro (Hex package)142* Getting nerves_system_qemu_aarch64 (Hex package)143* Getting nerves_system_rpi0 (Hex package)144* Getting nerves_system_rpi4 (Hex package)145* Getting nerves_system_rpi5 (Hex package)146* Getting nerves_system_trellis (Hex package)147* Getting nerves_system_x86_64 (Hex package)148* Getting nerves_system_br (Hex package)149* Getting nerves_toolchain_x86_64_nerves_linux_musl (Hex package)150* Getting nerves_toolchain_armv7_nerves_linux_gnueabihf (Hex package)151* Getting nerves_toolchain_aarch64_nerves_linux_gnu (Hex package)152* Getting nerves_toolchain_armv6_nerves_linux_gnueabihf (Hex package)153* Getting nerves_toolchain_riscv64_nerves_linux_gnu (Hex package)154* Getting nerves_logging (Hex package)155* Getting nerves_uevent (Hex package)156* Getting uboot_env (Hex package)157* Getting elixir_make (Hex package)158* Getting property_table (Hex package)159* Getting circular_buffer (Hex package)160* Getting interactive_cmd (Hex package)161* Getting nerves_discovery (Hex package)162* Getting tablet (Hex package)163* Getting ecto_sql (Hex package)164* Getting ex_gram (Hex package)165* Getting fluminus (Hex package)166* Getting jason (Hex package)167* Getting plug_cowboy (Hex package)168* Getting postgrex (Hex package)169* Getting db_connection (Hex package)170* Getting decimal (Hex package)171* Getting telemetry (Hex package)172* Getting cowboy (Hex package)173* Getting cowboy_telemetry (Hex package)174* Getting plug (Hex package)175* Getting mime (Hex package)176* Getting plug_crypto (Hex package)177* Getting cowlib (Hex package)178* Getting ranch (Hex package)179* Getting cookie (Hex package)180* Getting ffmpex (Hex package)181* Getting floki (Hex package)182* Getting html_entities (Hex package)183* Getting html_sanitize_ex (Hex package)184* Getting httpoison (Hex package)185* Getting hackney (Hex package)186* Getting certifi (Hex package)187* Getting idna (Hex package)188* Getting metrics (Hex package)189* Getting mimerl (Hex package)190* Getting parse_trans (Hex package)191* Getting ssl_verify_fun (Hex package)192* Getting unicode_util_compat (Hex package)193* Getting mochiweb (Hex package)194* Getting nimble_ownership (Hex package)195* Getting ecto (Hex package)196Found packages with security advisories, see above for details197You have added/upgraded packages you could sponsor, run `mix hex.sponsor` to learn more198==> nerves_system_br199Generated nerves_system_br app200==> html_entities201Compiling 2 files (.ex)202Generated html_entities app203==> mime204Compiling 1 file (.ex)205Generated mime app206==> circular_buffer207Compiling 1 file (.ex)208Generated circular_buffer app209==> plug_crypto210Compiling 5 files (.ex)211Generated plug_crypto app212==> nerves_compatibility_test213===> Analyzing applications...214===> Compiling mimerl215===> Analyzing applications...216===> Compiling ranch217==> ssl_verify_fun218Compiling 7 files (.erl)219Generated ssl_verify_fun app220==> tablet221Compiling 2 files (.ex)222Generated tablet app223==> elixir_make224Compiling 8 files (.ex)225Generated elixir_make app226==> nerves_logging227 CC kmsg_tailer.o228 LD kmsg_tailer229Compiling 5 files (.ex)230Generated nerves_logging app231==> nerves_compatibility_test232===> Analyzing applications...233===> Compiling cowlib234===> Analyzing applications...235===> Compiling mochiweb236    ┌─ src/mochiweb_acceptor.erl:237    │238 53 │      case catch do_accept(Server, Listen) of239    │           ╰── Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.240Compile directive 'nowarn_deprecated_catch' can be used to suppress241warnings in selected modules.242243244===> Compiling src/mochiweb_multipart.erl failed245     ┌─ src/mochiweb_multipart.erl:246     │247 278 │        {maybe, Start} ->248     │              ╰── syntax error before: ','249250     ┌─ src/mochiweb_multipart.erl:251     │252 331 │  		{maybe, Skip};253     │  		      ╰── syntax error before: ','254255256     ┌─ src/mochiweb_multipart.erl:257     │258 186 │      feed_mp(headers,259     │      ╰── function feed_mp/2 undefined260261262     ┌─ src/mochiweb_multipart.erl:263     │264 191 │  parse_headers(<<>>) -> [];265     │  ╰── Warning: function parse_headers/1 is unused266267     ┌─ src/mochiweb_multipart.erl:268     │269 194 │  parse_headers(Binary, Acc) ->270     │  ╰── Warning: function parse_headers/2 is unused271272     ┌─ src/mochiweb_multipart.erl:273     │274 202 │  split_header(Line) ->275     │  ╰── Warning: function split_header/1 is unused276277     ┌─ src/mochiweb_multipart.erl:278     │279 217 │  read_more(State = #mp{length = Length, buffer = Buffer,280     │  ╰── Warning: function read_more/1 is unused281282     ┌─ src/mochiweb_multipart.erl:283     │284 300 │  find_in_binary(P, Data) when size(P) > 0 ->285     │  ╰── Warning: function find_in_binary/2 is unused286287     ┌─ src/mochiweb_multipart.erl:288     │289 312 │  partial_find(_B, _D, _N, 0) -> not_found;290     │  ╰── Warning: function partial_find/4 is unused291292293** (Mix) Could not compile dependency :mochiweb, "/home/nerves/.mix/elixir/1-20-otp-29/rebar3 bare compile --paths /work/proj/_build/trellis/lib/*/ebin" command failed. Errors may have been logged above. You can recompile this dependency with "mix deps.compile mochiweb --force", update it with "mix deps.update mochiweb" or clean it with "mix deps.clean mochiweb"