Build log
nerves_system_qemu_aarch64
google_pubsub_grpc 0.2.1-beta.1 · fail · run google_pubsub_grpc-0.2.1-beta.1-1791190504542
357 of 357 lines
1Resolving Hex dependencies...2Resolution completed in 0.157s3Unchanged:4 certifi 2.15.05 circular_buffer 1.1.06 cowboy 2.7.0 VULNERABLE!7 EEF-CVE-2026-65624 (MEDIUM)8 aka: CVE-2026-656249 Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion10 https://osv.dev/vulnerability/EEF-CVE-2026-656241112 EEF-CVE-2026-8466 (HIGH)13 aka: CVE-2026-8466, GHSA-jfc2-q6qh-g5x814 Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy15 https://osv.dev/vulnerability/EEF-CVE-2026-84661617 GHSA-w4f7-4cxr-rv3c (MEDIUM)18 aka: CVE-2026-43966, EEF-CVE-2026-4396619 cowboy and gun affected by an HTTP Request/Response Splitting vulnerability20 https://osv.dev/vulnerability/GHSA-w4f7-4cxr-rv3c21 cowlib 2.8.0 VULNERABLE!22 EEF-CVE-2026-7790 (HIGH)23 aka: CVE-2026-7790, GHSA-32p9-57cr-4x6524 Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS25 https://osv.dev/vulnerability/EEF-CVE-2026-77902627 EEF-CVE-2026-43968 (MEDIUM)28 aka: CVE-2026-43968, GHSA-hv23-4qp7-8c8r29 CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/130 https://osv.dev/vulnerability/EEF-CVE-2026-439683132 EEF-CVE-2026-59248 (HIGH)33 aka: CVE-2026-5924834 Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS35 https://osv.dev/vulnerability/EEF-CVE-2026-592483637 EEF-CVE-2026-43970 (HIGH)38 aka: CVE-2026-43970, GHSA-84f2-rp86-235p39 Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame40 https://osv.dev/vulnerability/EEF-CVE-2026-4397041 elixir_make 0.10.042 google_pubsub_grpc 0.2.1-beta.143 goth 1.2.044 grpc 0.5.0-beta.1 VULNERABLE!45 EEF-CVE-2026-53430 (HIGH)46 aka: CVE-2026-53430, GHSA-6ccx-9c9f-327w47 grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/148 https://osv.dev/vulnerability/EEF-CVE-2026-534304950 EEF-CVE-2026-48853 (CRITICAL)51 aka: CVE-2026-48853, GHSA-grp7-v8xh-rj7h52 Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc53 https://osv.dev/vulnerability/EEF-CVE-2026-488535455 EEF-CVE-2026-48854 (HIGH)56 aka: CVE-2026-48854, GHSA-q8gf-9rvj-gmgj57 Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc58 https://osv.dev/vulnerability/EEF-CVE-2026-4885459 grpc_gun 2.0.060 hackney 1.25.0 VULNERABLE!61 EEF-CVE-2026-47071 (HIGH)62 aka: CVE-2026-47071, GHSA-gp9c-pm5m-5cxr63 SOCKS5 TLS upgrade ignores caller timeout in hackney64 https://osv.dev/vulnerability/EEF-CVE-2026-470716566 EEF-CVE-2026-47076 (MEDIUM)67 aka: CVE-2026-47076, GHSA-pj7v-xfvx-wmjq68 SSRF allowlist bypass via percent-encoded host in hackney69 https://osv.dev/vulnerability/EEF-CVE-2026-470767071 EEF-CVE-2026-47069 (LOW)72 aka: CVE-2026-47069, GHSA-mp55-p8c9-rfw273 CRLF injection in cookie domain/path options in hackney74 https://osv.dev/vulnerability/EEF-CVE-2026-470697576 EEF-CVE-2026-47075 (MEDIUM)77 aka: CVE-2026-47075, GHSA-j9wq-vxxc-94wf78 CR/LF injection in query parameter in hackney79 https://osv.dev/vulnerability/EEF-CVE-2026-4707580 httpoison 1.8.281 idna 6.1.182 interactive_cmd 0.1.483 jason 1.4.584 joken 2.7.085 jose 1.11.1286 metrics 1.0.187 mimerl 1.5.088 nerves 2.0.0-pre.289 nerves_discovery 0.1.590 nerves_logging 0.2.491 nerves_runtime 0.13.1392 nerves_system_bbb 2.30.293 nerves_system_br 1.34.494 nerves_system_mangopi_mq_pro 0.17.295 nerves_system_qemu_aarch64 0.4.296 nerves_system_rpi0 2.1.297 nerves_system_rpi4 2.1.298 nerves_system_rpi5 2.1.299 nerves_system_trellis 0.5.0100 nerves_system_x86_64 1.34.2101 nerves_toolchain_aarch64_nerves_linux_gnu 15.3.1102 nerves_toolchain_armv6_nerves_linux_gnueabihf 15.3.1103 nerves_toolchain_armv7_nerves_linux_gnueabihf 15.3.1104 nerves_toolchain_riscv64_nerves_linux_gnu 15.3.1105 nerves_toolchain_x86_64_nerves_linux_musl 15.3.1106 nerves_uevent 0.1.7107 parse_trans 3.4.1108 property_table 0.3.4109 protobuf 0.17.0110 ranch 1.7.1111 ring_logger 0.11.7112 ssl_verify_fun 1.1.7113 tablet 0.3.3114 toolshed 0.5.0115 uboot_env 1.0.2116 unicode_util_compat 0.7.1117* Getting google_pubsub_grpc (Hex package)118* Getting nerves (Hex package)119* Getting ring_logger (Hex package)120* Getting toolshed (Hex package)121* Getting nerves_runtime (Hex package)122* Getting nerves_system_bbb (Hex package)123* Getting nerves_system_mangopi_mq_pro (Hex package)124* Getting nerves_system_qemu_aarch64 (Hex package)125* Getting nerves_system_rpi0 (Hex package)126* Getting nerves_system_rpi4 (Hex package)127* Getting nerves_system_rpi5 (Hex package)128* Getting nerves_system_trellis (Hex package)129* Getting nerves_system_x86_64 (Hex package)130* Getting nerves_system_br (Hex package)131* Getting nerves_toolchain_x86_64_nerves_linux_musl (Hex package)132* Getting nerves_toolchain_armv7_nerves_linux_gnueabihf (Hex package)133* Getting nerves_toolchain_aarch64_nerves_linux_gnu (Hex package)134* Getting nerves_toolchain_armv6_nerves_linux_gnueabihf (Hex package)135* Getting nerves_toolchain_riscv64_nerves_linux_gnu (Hex package)136* Getting nerves_logging (Hex package)137* Getting nerves_uevent (Hex package)138* Getting uboot_env (Hex package)139* Getting elixir_make (Hex package)140* Getting property_table (Hex package)141* Getting circular_buffer (Hex package)142* Getting interactive_cmd (Hex package)143* Getting nerves_discovery (Hex package)144* Getting tablet (Hex package)145* Getting cowboy (Hex package)146* Getting goth (Hex package)147* Getting grpc (Hex package)148* Getting gun (Hex package)149* Getting protobuf (Hex package)150* Getting cowlib (Hex package)151* Getting httpoison (Hex package)152* Getting jason (Hex package)153* Getting joken (Hex package)154* Getting jose (Hex package)155* Getting hackney (Hex package)156* Getting certifi (Hex package)157* Getting idna (Hex package)158* Getting metrics (Hex package)159* Getting mimerl (Hex package)160* Getting parse_trans (Hex package)161* Getting ssl_verify_fun (Hex package)162* Getting unicode_util_compat (Hex package)163* Getting ranch (Hex package)164Found packages with security advisories, see above for details165==> nerves_system_br166Generated nerves_system_br app167==> circular_buffer168Compiling 1 file (.ex)169Generated circular_buffer app170==> jason171Compiling 10 files (.ex)172Generated jason app173==> nerves_compatibility_test174===> Analyzing applications...175===> Compiling mimerl176==> jose177Compiling 113 files (.erl)178src/jose_server.erl:137:7: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.179Compile directive 'nowarn_deprecated_catch' can be used to suppress180warnings in selected modules.181% 137| _ = catch jose_jwa:unsecured_signing(UnsecuredSigning),182% | ^183184src/jose_server.erl:797:7: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.185Compile directive 'nowarn_deprecated_catch' can be used to suppress186warnings in selected modules.187% 797| case catch jose_crypto_compat:crypto_one_time(Cipher, Key, PlainText, true) of188% | ^189190src/jose_server.erl:799:9: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.191Compile directive 'nowarn_deprecated_catch' can be used to suppress192warnings in selected modules.193% 799| case catch jose_crypto_compat:crypto_one_time(Cipher, Key, CipherText, false) of194% | ^195196src/jose_server.erl:809:7: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.197Compile directive 'nowarn_deprecated_catch' can be used to suppress198warnings in selected modules.199% 809| case catch jose_crypto_compat:crypto_one_time(Cipher, Key, IV, PlainText, true) of200% | ^201202src/jose_server.erl:811:9: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.203Compile directive 'nowarn_deprecated_catch' can be used to suppress204warnings in selected modules.205% 811| case catch jose_crypto_compat:crypto_one_time(Cipher, Key, IV, CipherText, false) of206% | ^207208src/jose_server.erl:821:7: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.209Compile directive 'nowarn_deprecated_catch' can be used to suppress210warnings in selected modules.211% 821| case catch jose_crypto_compat:crypto_one_time(Cipher, Key, IV, {AAD, PlainText}, true) of212% | ^213214src/jose_server.erl:823:9: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.215Compile directive 'nowarn_deprecated_catch' can be used to suppress216warnings in selected modules.217% 823| case catch jose_crypto_compat:crypto_one_time(Cipher, Key, IV, {AAD, CipherText, CipherTag}, false) of218% | ^219220src/jose_server.erl:837:7: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.221Compile directive 'nowarn_deprecated_catch' can be used to suppress222warnings in selected modules.223% 837| case catch public_key:encrypt_public(PlainText, PublicKey, FutureOptions) of224% | ^225226src/jose_server.erl:840:9: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.227Compile directive 'nowarn_deprecated_catch' can be used to suppress228warnings in selected modules.229% 840| case catch public_key:decrypt_private(CipherText, PrivateKey, FutureOptions) of230% | ^231232src/jose_server.erl:842:11: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.233Compile directive 'nowarn_deprecated_catch' can be used to suppress234warnings in selected modules.235% 842| case catch public_key:decrypt_private(rsa_ciphertext(Algorithm), PrivateKey, FutureOptions) of236% | ^237238src/jose_server.erl:859:7: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.239Compile directive 'nowarn_deprecated_catch' can be used to suppress240warnings in selected modules.241% 859| case catch public_key:encrypt_public(PlainText, PublicKey, LegacyOptions) of242% | ^243244src/jose_server.erl:862:9: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.245Compile directive 'nowarn_deprecated_catch' can be used to suppress246warnings in selected modules.247% 862| case catch public_key:decrypt_private(CipherText, PrivateKey, LegacyOptions) of248% | ^249250src/jose_server.erl:864:11: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.251Compile directive 'nowarn_deprecated_catch' can be used to suppress252warnings in selected modules.253% 864| case catch public_key:decrypt_private(rsa_ciphertext(Algorithm), PrivateKey, LegacyOptions) of254% | ^255256src/jose_server.erl:882:7: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.257Compile directive 'nowarn_deprecated_catch' can be used to suppress258warnings in selected modules.259% 882| case catch public_key:sign(Message, DigestType, PrivateKey, Options) of260% | ^261262src/jose_server.erl:885:9: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.263Compile directive 'nowarn_deprecated_catch' can be used to suppress264warnings in selected modules.265% 885| case catch public_key:verify(Message, DigestType, Signature, PublicKey, Options) of266% | ^267268src/jose_server.erl:897:7: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.269Compile directive 'nowarn_deprecated_catch' can be used to suppress270warnings in selected modules.271% 897| case catch public_key:sign(Message, DigestType, PrivateKey) of272% | ^273274src/jose_server.erl:900:9: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.275Compile directive 'nowarn_deprecated_catch' can be used to suppress276warnings in selected modules.277% 900| case catch public_key:verify(Message, DigestType, Signature, PublicKey) of278% | ^279280src/jwa/jose_jwa.erl:230:7: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.281Compile directive 'nowarn_deprecated_catch' can be used to suppress282warnings in selected modules.283% 230| case catch block_cipher(Cipher) of284% | ^285286src/jwa/jose_jwa.erl:238:7: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.287Compile directive 'nowarn_deprecated_catch' can be used to suppress288warnings in selected modules.289% 238| case catch ?MAYBE_START_JOSE(ets:lookup_element(?TAB, chacha20_poly1305_module, 2)) of290% | ^291292src/jwa/jose_jwa.erl:246:7: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.293Compile directive 'nowarn_deprecated_catch' can be used to suppress294warnings in selected modules.295% 246| case catch rsa_crypt(Padding) of296% | ^297298src/jwa/jose_jwa.erl:254:7: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.299Compile directive 'nowarn_deprecated_catch' can be used to suppress300warnings in selected modules.301% 254| case catch rsa_sign(Padding) of302% | ^303304src/jwa/jose_jwa.erl:262:7: Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.305Compile directive 'nowarn_deprecated_catch' can be used to suppress306warnings in selected modules.307% 262| case catch ?MAYBE_START_JOSE(ets:lookup_element(?TAB, xchacha20_poly1305_module, 2)) of308% | ^309310Compiling 8 files (.ex)311Generated jose app312==> nerves_compatibility_test313===> Analyzing applications...314===> Compiling ranch315 ┌─ src/ranch_conns_sup.erl:316 │317 80 │ catch erlang:send(SupPid, {?MODULE, active_connections, self(), Tag},318 │ ╰── Warning: 'catch ...' is deprecated; please use 'try ... catch ... end' instead.319Compile directive 'nowarn_deprecated_catch' can be used to suppress320warnings in selected modules.321322323 ┌─ src/ranch_ssl.erl:324 │325 142 │ case ssl:ssl_accept(CSocket, Opts, Timeout) of326 │ ╰── Warning: ssl:ssl_accept/3 is removed; use ssl:handshake/1,2,3 instead327328329==> ssl_verify_fun330Compiling 7 files (.erl)331Generated ssl_verify_fun app332==> tablet333Compiling 2 files (.ex)334Generated tablet app335==> protobuf336Compiling 50 files (.ex)337Compiling lib/google/protobuf.ex (it's taking more than 10s)338Generated protobuf app339==> elixir_make340Compiling 8 files (.ex)341Generated elixir_make app342==> nerves_logging343 CC kmsg_tailer.o344 LD kmsg_tailer345Compiling 5 files (.ex)346Generated nerves_logging app347==> nerves_compatibility_test348===> Analyzing applications...349===> Compiling cowlib350===> Compiling src/cow_sse.erl failed351 ┌─ src/cow_sse.erl:352 │353 56 │ -> {event, parsed_event(), State} | {more, State}.354 │ ╰── type variable 'State' is only used once (is unbound)355356357** (Mix) Could not compile dependency :cowlib, "/home/nerves/.mix/elixir/1-20-otp-29/rebar3 bare compile --paths /work/proj/_build/qemu_aarch64/lib/*/ebin" command failed. Errors may have been logged above. You can recompile this dependency with "mix deps.compile cowlib --force", update it with "mix deps.update cowlib" or clean it with "mix deps.clean cowlib"