host

1Resolving Hex dependencies...2Resolution completed in 0.184s3Unchanged:4  bandit 0.7.7 VULNERABLE!5    EEF-CVE-2026-42788 (MEDIUM)6    aka: CVE-2026-42788, GHSA-q6v9-r226-v65f7    HTTP/2 frame size limit checked after body is buffered in bandit8    https://osv.dev/vulnerability/EEF-CVE-2026-42788910    EEF-CVE-2026-39805 (MEDIUM)11    aka: CVE-2026-39805, GHSA-c67r-gc9j-2qf712    CL.CL HTTP request smuggling via duplicate Content-Length in bandit13    https://osv.dev/vulnerability/EEF-CVE-2026-398051415    EEF-CVE-2026-42786 (HIGH)16    aka: CVE-2026-42786, GHSA-pf94-94m9-536p17    WebSocket fragmented message reassembly unbounded in bandit18    https://osv.dev/vulnerability/EEF-CVE-2026-427861920    EEF-CVE-2026-39804 (HIGH)21    aka: CVE-2026-39804, GHSA-frh3-6pv6-rc8j22    WebSocket permessage-deflate inflate has no output-size cap in bandit23    https://osv.dev/vulnerability/EEF-CVE-2026-398042425    EEF-CVE-2026-74836 (HIGH)26    aka: CVE-2026-74836, GHSA-xj8g-532w-jv9427    HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit28    https://osv.dev/vulnerability/EEF-CVE-2026-7483629  circular_buffer 1.1.030  cors_plug 3.0.331  db_connection 2.10.232  decimal 3.1.133  ecto 3.14.234  ecto_sql 3.14.035  elixir_make 0.10.036  ets 0.9.037  hammer 6.2.138  hpax 0.1.2 VULNERABLE!39    EEF-CVE-2026-58226 (HIGH)40    aka: CVE-2026-58226, GHSA-jj2p-32j7-whj241    Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax42    https://osv.dev/vulnerability/EEF-CVE-2026-5822643  interactive_cmd 0.1.444  jason 1.4.545  k256 0.0.846  mime 2.0.747  nerves 2.0.0-pre.248  nerves_discovery 0.1.549  nerves_logging 0.2.450  nerves_runtime 0.13.1351  nerves_system_bbb 2.30.252  nerves_system_br 1.34.453  nerves_system_mangopi_mq_pro 0.17.254  nerves_system_qemu_aarch64 0.4.255  nerves_system_rpi0 2.1.256  nerves_system_rpi4 2.1.257  nerves_system_rpi5 2.1.258  nerves_system_trellis 0.5.059  nerves_system_x86_64 1.34.260  nerves_toolchain_aarch64_nerves_linux_gnu 15.3.161  nerves_toolchain_armv6_nerves_linux_gnueabihf 15.3.162  nerves_toolchain_armv7_nerves_linux_gnueabihf 15.3.163  nerves_toolchain_riscv64_nerves_linux_gnu 15.3.164  nerves_toolchain_x86_64_nerves_linux_musl 15.3.165  nerves_uevent 0.1.766  nex 0.1.067  phoenix_pubsub 2.3.068  plug 1.20.369  plug_crypto 2.2.070  poolboy 1.5.271  postgrex 0.22.472  property_table 0.3.473  ring_logger 0.11.774  rustler 0.29.175  rustler_precompiled 0.10.076  tablet 0.3.377  telemetry 1.4.278  thousand_island 0.6.779  toml 0.7.080  toolshed 0.5.081  uboot_env 1.0.282  websock 0.5.383Found packages with security advisories, see above for details84All dependencies have been fetched85==> hpax86Compiling 4 files (.ex)87    warning: the variable "padding_size" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator88    │89 79 │     <<padding::size(padding_size)>> = padding90    │                     ~91    │92    └─ lib/hpax/huffman.ex:79:21: HPAX.Huffman.decode/19394warning: 62..@dynamic_table_start + length - 1 inside guards requires an explicit step, please write 62..@dynamic_table_start + length - 1//1 or 62..@dynamic_table_start + length - 1//-1 instead95  lib/hpax/table.ex:153: HPAX.Table.lookup_by_index/29697    warning: the variable "prefix" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator98    │99 50 │     with <<value::size(prefix), rest::binary>> <- bitstring do100    │                        ~101    │102    └─ lib/hpax/types.ex:50:24: HPAX.Types.decode_integer/2103104    warning: the variable "length" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator105    │106 77 │          <<contents::binary-size(length), rest::binary>> <- rest do107    │                                  ~108    │109    └─ lib/hpax/types.ex:77:34: HPAX.Types.decode_binary/1110111Generated hpax app112==> rustler113Compiling 7 files (.ex)114     warning: using single-quoted strings to represent charlists is deprecated.115     Use ~c"" if you indeed want a charlist or use "" instead.116     You may run "mix format --migrate" to change all single-quoted117     strings to use the ~c sigil and fix this warning.118     │119 173 │       '2.14',120     │       ~121     │122     └─ lib/rustler.ex:173:7123124     warning: using single-quoted strings to represent charlists is deprecated.125     Use ~c"" if you indeed want a charlist or use "" instead.126     You may run "mix format --migrate" to change all single-quoted127     strings to use the ~c sigil and fix this warning.128     │129 174 │       '2.15',130     │       ~131     │132     └─ lib/rustler.ex:174:7133134     warning: using single-quoted strings to represent charlists is deprecated.135     Use ~c"" if you indeed want a charlist or use "" instead.136     You may run "mix format --migrate" to change all single-quoted137     strings to use the ~c sigil and fix this warning.138     │139 175 │       '2.16'140     │       ~141     │142     └─ lib/rustler.ex:175:7143144     warning: incompatible types given to throw_error/1:145146         throw_error(147           {:unknown_target,148            <<to_string(target)::binary,149              " is not in the support list yet. Please report it on https://github.com/rusterlium/rustler/issues.">>}150         )151152     given types:153154         -dynamic({:unknown_target, binary()})-155156     but expected one of:157158         :no_config or :no_crates_property or :rustup_not_installed or {:no_rustler_deps, term(), term()} or159           {:differing_versions or :unsupported_rustler_version, term(), term(), term()} or160           {:cargo_no_name or :cargo_toml_not_found or :nonexistent_crate_directory or161              :rust_version_not_installed or :unsupported_nif_version, term()}162163     where "target" was given the types:164165         # type: binary()166         # from: lib/rustler/compiler.ex:144:27167         target168169         # type: binary()170         # from: lib/rustler/compiler.ex:144:40171         is_binary(target)172173     type warning found at:174     │175 160 │       throw_error(176     │       ~177     │178     └─ lib/rustler/compiler.ex:160:7: Rustler.Compiler.get_target_os_type/1179180Generated rustler app181==> thousand_island182Compiling 16 files (.ex)183Generated thousand_island app184==> rustler_precompiled185Compiling 4 files (.ex)186Generated rustler_precompiled app187==> k256188Compiling 3 files (.ex)18919008:52:59.781 [debug] Downloading NIF from https://github.com/RooSoft/k256/releases/download/0.0.8/libk256_rs-v0.0.8-nif-2.15-x86_64-unknown-linux-gnu.so.tar.gz19119208:53:00.397 [debug] NIF cached at /home/nerves/.cache/rustler_precompiled/precompiled_nifs/libk256_rs-v0.0.8-nif-2.15-x86_64-unknown-linux-gnu.so.tar.gz and extracted to /work/proj/_build/host/lib/k256/priv/native/libk256_rs-v0.0.8-nif-2.15-x86_64-unknown-linux-gnu.so193Generated k256 app194==> hammer195Compiling 6 files (.ex)196    warning: unused require Logger197    │198 56 │   require Logger199    │   ~200    │201    └─ lib/hammer/application.ex:56:3202203Generated hammer app204==> cors_plug205Compiling 1 file (.ex)206Generated cors_plug app207==> bandit208Compiling 47 files (.ex)209     warning: the variable "max_desired_bytes" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator210     │211 200 │       <<to_return::binary-size(max_desired_bytes), rest::binary>> = buffer212     │                                ~213     │214     └─ lib/bandit/http1/adapter.ex:200:32: Bandit.HTTP1.Adapter.read_req_body/2215216     warning: the variable "chunk_size" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator217     │218 269 │           <<next_chunk::binary-size(chunk_size), ?\r, ?\n, rest::binary>> ->219     │                                     ~220     │221     └─ lib/bandit/http1/adapter.ex:269:37: Bandit.HTTP1.Adapter.do_read_chunk/3222223    warning: the variable "max_frame_size" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator224    │225 49 │         <<this_frame::binary-size(max_frame_size), rest::binary>> =226    │                                   ~227    │228    └─ lib/bandit/http2/frame/continuation.ex:49:35: Bandit.HTTP2.Frame.Serializable.Bandit.HTTP2.Frame.Continuation.serialize/2229230    warning: the variable "max_frame_size" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator231    │232 67 │         <<this_frame::binary-size(max_frame_size), rest::binary>> =233    │                                   ~234    │235    └─ lib/bandit/http2/frame/data.ex:67:35: Bandit.HTTP2.Frame.Serializable.Bandit.HTTP2.Frame.Data.serialize/2236237     warning: the variable "max_frame_size" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator238     │239 128 │         <<this_frame::binary-size(max_frame_size), rest::binary>> =240     │                                   ~241     │242     └─ lib/bandit/http2/frame/headers.ex:128:35: Bandit.HTTP2.Frame.Serializable.Bandit.HTTP2.Frame.Headers.serialize/2243244     warning: the variable "desired_length" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator245     │246 475 │       <<to_send::binary-size(desired_length), rest::binary>> = IO.iodata_to_binary(data)247     │                              ~248     │249     └─ lib/bandit/http2/connection.ex:475:30: Bandit.HTTP2.Connection.split_data/2250251     warning: the variable "deflated_size" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator252     │253 134 │         <<deflated_data::binary-size(deflated_size), 0x00, 0x00, 0xFF, 0xFF>> -> deflated_data254     │                                      ~255     │256     └─ lib/bandit/websocket/permessage_deflate.ex:134:38: Bandit.WebSocket.PerMessageDeflate.deflate/2257258Generated bandit app259==> nex260Compiling 18 files (.ex)261     warning: the variable "pow" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator262     │263 162 │     case is_integer(pow) and match?(<<0::size(pow), _::bitstring>>, id) do264     │                                               ~265     │266     └─ lib/nex/messages/event.ex:162:47: Nex.Messages.Event.validate_pow/1267268269== Compilation error in file lib/nex/plug.ex ==270** (File.Error) could not read file "priv/static/index.html.eex": no such file or directory271    (elixir 1.20.3) lib/file.ex:451: File.read!/2272    (eex 1.20.3) lib/eex.ex:282: EEx.compile_file/2273    lib/nex/plug.ex:23: (module)274could not compile dependency :nex, "mix compile" failed. Errors may have been logged above. You can recompile this dependency with "mix deps.compile nex --force", update it with "mix deps.update nex" or clean it with "mix deps.clean nex"