Build log
nerves_system_x86_64
nex 0.1.0 · fail · run nex-0.1.0-1791017551150
324 of 324 lines
1Resolving Hex dependencies...2Resolution completed in 0.152s3Unchanged:4 bandit 0.7.7 VULNERABLE!5 EEF-CVE-2026-42788 (MEDIUM)6 aka: CVE-2026-42788, GHSA-q6v9-r226-v65f7 HTTP/2 frame size limit checked after body is buffered in bandit8 https://osv.dev/vulnerability/EEF-CVE-2026-42788910 EEF-CVE-2026-39805 (MEDIUM)11 aka: CVE-2026-39805, GHSA-c67r-gc9j-2qf712 CL.CL HTTP request smuggling via duplicate Content-Length in bandit13 https://osv.dev/vulnerability/EEF-CVE-2026-398051415 EEF-CVE-2026-42786 (HIGH)16 aka: CVE-2026-42786, GHSA-pf94-94m9-536p17 WebSocket fragmented message reassembly unbounded in bandit18 https://osv.dev/vulnerability/EEF-CVE-2026-427861920 EEF-CVE-2026-39804 (HIGH)21 aka: CVE-2026-39804, GHSA-frh3-6pv6-rc8j22 WebSocket permessage-deflate inflate has no output-size cap in bandit23 https://osv.dev/vulnerability/EEF-CVE-2026-398042425 EEF-CVE-2026-74836 (HIGH)26 aka: CVE-2026-74836, GHSA-xj8g-532w-jv9427 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit28 https://osv.dev/vulnerability/EEF-CVE-2026-7483629 circular_buffer 1.1.030 cors_plug 3.0.331 db_connection 2.10.232 decimal 3.1.133 ecto 3.14.234 ecto_sql 3.14.035 elixir_make 0.10.036 ets 0.9.037 hammer 6.2.138 hpax 0.1.2 VULNERABLE!39 EEF-CVE-2026-58226 (HIGH)40 aka: CVE-2026-58226, GHSA-jj2p-32j7-whj241 Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax42 https://osv.dev/vulnerability/EEF-CVE-2026-5822643 interactive_cmd 0.1.444 jason 1.4.545 k256 0.0.846 mime 2.0.747 nerves 2.0.0-pre.248 nerves_discovery 0.1.549 nerves_logging 0.2.450 nerves_runtime 0.13.1351 nerves_system_bbb 2.30.252 nerves_system_br 1.34.453 nerves_system_mangopi_mq_pro 0.17.254 nerves_system_qemu_aarch64 0.4.255 nerves_system_rpi0 2.1.256 nerves_system_rpi4 2.1.257 nerves_system_rpi5 2.1.258 nerves_system_trellis 0.5.059 nerves_system_x86_64 1.34.260 nerves_toolchain_aarch64_nerves_linux_gnu 15.3.161 nerves_toolchain_armv6_nerves_linux_gnueabihf 15.3.162 nerves_toolchain_armv7_nerves_linux_gnueabihf 15.3.163 nerves_toolchain_riscv64_nerves_linux_gnu 15.3.164 nerves_toolchain_x86_64_nerves_linux_musl 15.3.165 nerves_uevent 0.1.766 nex 0.1.067 phoenix_pubsub 2.3.068 plug 1.20.369 plug_crypto 2.2.070 poolboy 1.5.271 postgrex 0.22.472 property_table 0.3.473 ring_logger 0.11.774 rustler 0.29.175 rustler_precompiled 0.10.076 tablet 0.3.377 telemetry 1.4.278 thousand_island 0.6.779 toml 0.7.080 toolshed 0.5.081 uboot_env 1.0.282 websock 0.5.383* Getting nex (Hex package)84* Getting nerves (Hex package)85* Getting ring_logger (Hex package)86* Getting toolshed (Hex package)87* Getting nerves_runtime (Hex package)88* Getting nerves_system_bbb (Hex package)89* Getting nerves_system_mangopi_mq_pro (Hex package)90* Getting nerves_system_qemu_aarch64 (Hex package)91* Getting nerves_system_rpi0 (Hex package)92* Getting nerves_system_rpi4 (Hex package)93* Getting nerves_system_rpi5 (Hex package)94* Getting nerves_system_trellis (Hex package)95* Getting nerves_system_x86_64 (Hex package)96* Getting nerves_system_br (Hex package)97* Getting nerves_toolchain_x86_64_nerves_linux_musl (Hex package)98* Getting nerves_toolchain_armv7_nerves_linux_gnueabihf (Hex package)99* Getting nerves_toolchain_aarch64_nerves_linux_gnu (Hex package)100* Getting nerves_toolchain_armv6_nerves_linux_gnueabihf (Hex package)101* Getting nerves_toolchain_riscv64_nerves_linux_gnu (Hex package)102* Getting nerves_logging (Hex package)103* Getting nerves_uevent (Hex package)104* Getting uboot_env (Hex package)105* Getting elixir_make (Hex package)106* Getting property_table (Hex package)107* Getting circular_buffer (Hex package)108* Getting interactive_cmd (Hex package)109* Getting nerves_discovery (Hex package)110* Getting tablet (Hex package)111* Getting bandit (Hex package)112* Getting cors_plug (Hex package)113* Getting ecto_sql (Hex package)114* Getting ets (Hex package)115* Getting hammer (Hex package)116* Getting jason (Hex package)117* Getting k256 (Hex package)118* Getting phoenix_pubsub (Hex package)119* Getting plug (Hex package)120* Getting postgrex (Hex package)121* Getting db_connection (Hex package)122* Getting decimal (Hex package)123* Getting telemetry (Hex package)124* Getting mime (Hex package)125* Getting plug_crypto (Hex package)126* Getting rustler (Hex package)127* Getting rustler_precompiled (Hex package)128* Getting toml (Hex package)129* Getting poolboy (Hex package)130* Getting ecto (Hex package)131* Getting hpax (Hex package)132* Getting thousand_island (Hex package)133* Getting websock (Hex package)134Found packages with security advisories, see above for details135==> hpax136Compiling 4 files (.ex)137warning: 62..@dynamic_table_start + length - 1 inside guards requires an explicit step, please write 62..@dynamic_table_start + length - 1//1 or 62..@dynamic_table_start + length - 1//-1 instead138 lib/hpax/table.ex:153: HPAX.Table.lookup_by_index/2139140 warning: the variable "padding_size" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator141 │142 79 │ <<padding::size(padding_size)>> = padding143 │ ~144 │145 └─ lib/hpax/huffman.ex:79:21: HPAX.Huffman.decode/1146147 warning: the variable "prefix" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator148 │149 50 │ with <<value::size(prefix), rest::binary>> <- bitstring do150 │ ~151 │152 └─ lib/hpax/types.ex:50:24: HPAX.Types.decode_integer/2153154 warning: the variable "length" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator155 │156 77 │ <<contents::binary-size(length), rest::binary>> <- rest do157 │ ~158 │159 └─ lib/hpax/types.ex:77:34: HPAX.Types.decode_binary/1160161Generated hpax app162==> rustler163Compiling 7 files (.ex)164 warning: using single-quoted strings to represent charlists is deprecated.165 Use ~c"" if you indeed want a charlist or use "" instead.166 You may run "mix format --migrate" to change all single-quoted167 strings to use the ~c sigil and fix this warning.168 │169 173 │ '2.14',170 │ ~171 │172 └─ lib/rustler.ex:173:7173174 warning: using single-quoted strings to represent charlists is deprecated.175 Use ~c"" if you indeed want a charlist or use "" instead.176 You may run "mix format --migrate" to change all single-quoted177 strings to use the ~c sigil and fix this warning.178 │179 174 │ '2.15',180 │ ~181 │182 └─ lib/rustler.ex:174:7183184 warning: using single-quoted strings to represent charlists is deprecated.185 Use ~c"" if you indeed want a charlist or use "" instead.186 You may run "mix format --migrate" to change all single-quoted187 strings to use the ~c sigil and fix this warning.188 │189 175 │ '2.16'190 │ ~191 │192 └─ lib/rustler.ex:175:7193194 warning: incompatible types given to throw_error/1:195196 throw_error(197 {:unknown_target,198 <<to_string(target)::binary,199 " is not in the support list yet. Please report it on https://github.com/rusterlium/rustler/issues.">>}200 )201202 given types:203204 -dynamic({:unknown_target, binary()})-205206 but expected one of:207208 :no_config or :no_crates_property or :rustup_not_installed or {:no_rustler_deps, term(), term()} or209 {:differing_versions or :unsupported_rustler_version, term(), term(), term()} or210 {:cargo_no_name or :cargo_toml_not_found or :nonexistent_crate_directory or211 :rust_version_not_installed or :unsupported_nif_version, term()}212213 where "target" was given the types:214215 # type: binary()216 # from: lib/rustler/compiler.ex:144:27217 target218219 # type: binary()220 # from: lib/rustler/compiler.ex:144:40221 is_binary(target)222223 type warning found at:224 │225 160 │ throw_error(226 │ ~227 │228 └─ lib/rustler/compiler.ex:160:7: Rustler.Compiler.get_target_os_type/1229230Generated rustler app231==> thousand_island232Compiling 16 files (.ex)233Generated thousand_island app234==> rustler_precompiled235Compiling 4 files (.ex)236Generated rustler_precompiled app237==> k256238Compiling 3 files (.ex)23924008:58:48.041 [debug] Downloading NIF from https://github.com/RooSoft/k256/releases/download/0.0.8/libk256_rs-v0.0.8-nif-2.15-x86_64-unknown-linux-musl.so.tar.gz24124208:58:49.214 [debug] NIF cached at /home/nerves/.cache/rustler_precompiled/precompiled_nifs/libk256_rs-v0.0.8-nif-2.15-x86_64-unknown-linux-musl.so.tar.gz and extracted to /work/proj/_build/x86_64/lib/k256/priv/native/libk256_rs-v0.0.8-nif-2.15-x86_64-unknown-linux-musl.so243Generated k256 app244==> hammer245Compiling 6 files (.ex)246 warning: unused require Logger247 │248 56 │ require Logger249 │ ~250 │251 └─ lib/hammer/application.ex:56:3252253Generated hammer app254==> cors_plug255Compiling 1 file (.ex)256Generated cors_plug app257==> bandit258Compiling 47 files (.ex)259 warning: the variable "max_desired_bytes" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator260 │261 200 │ <<to_return::binary-size(max_desired_bytes), rest::binary>> = buffer262 │ ~263 │264 └─ lib/bandit/http1/adapter.ex:200:32: Bandit.HTTP1.Adapter.read_req_body/2265266 warning: the variable "chunk_size" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator267 │268 269 │ <<next_chunk::binary-size(chunk_size), ?\r, ?\n, rest::binary>> ->269 │ ~270 │271 └─ lib/bandit/http1/adapter.ex:269:37: Bandit.HTTP1.Adapter.do_read_chunk/3272273 warning: the variable "max_frame_size" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator274 │275 67 │ <<this_frame::binary-size(max_frame_size), rest::binary>> =276 │ ~277 │278 └─ lib/bandit/http2/frame/data.ex:67:35: Bandit.HTTP2.Frame.Serializable.Bandit.HTTP2.Frame.Data.serialize/2279280 warning: the variable "max_frame_size" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator281 │282 128 │ <<this_frame::binary-size(max_frame_size), rest::binary>> =283 │ ~284 │285 └─ lib/bandit/http2/frame/headers.ex:128:35: Bandit.HTTP2.Frame.Serializable.Bandit.HTTP2.Frame.Headers.serialize/2286287 warning: the variable "max_frame_size" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator288 │289 49 │ <<this_frame::binary-size(max_frame_size), rest::binary>> =290 │ ~291 │292 └─ lib/bandit/http2/frame/continuation.ex:49:35: Bandit.HTTP2.Frame.Serializable.Bandit.HTTP2.Frame.Continuation.serialize/2293294 warning: the variable "desired_length" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator295 │296 475 │ <<to_send::binary-size(desired_length), rest::binary>> = IO.iodata_to_binary(data)297 │ ~298 │299 └─ lib/bandit/http2/connection.ex:475:30: Bandit.HTTP2.Connection.split_data/2300301 warning: the variable "deflated_size" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator302 │303 134 │ <<deflated_data::binary-size(deflated_size), 0x00, 0x00, 0xFF, 0xFF>> -> deflated_data304 │ ~305 │306 └─ lib/bandit/websocket/permessage_deflate.ex:134:38: Bandit.WebSocket.PerMessageDeflate.deflate/2307308Generated bandit app309==> nex310Compiling 18 files (.ex)311 warning: the variable "pow" is accessed inside size(...) of a bitstring but it was defined outside of the match. You must precede it with the pin operator312 │313 162 │ case is_integer(pow) and match?(<<0::size(pow), _::bitstring>>, id) do314 │ ~315 │316 └─ lib/nex/messages/event.ex:162:47: Nex.Messages.Event.validate_pow/1317318319== Compilation error in file lib/nex/plug.ex ==320** (File.Error) could not read file "priv/static/index.html.eex": no such file or directory321 (elixir 1.20.3) lib/file.ex:451: File.read!/2322 (eex 1.20.3) lib/eex.ex:282: EEx.compile_file/2323 lib/nex/plug.ex:23: (module)324could not compile dependency :nex, "mix compile" failed. Errors may have been logged above. You can recompile this dependency with "mix deps.compile nex --force", update it with "mix deps.update nex" or clean it with "mix deps.clean nex"