tomekowal
I am using mix hex.audit to make my CI pipeline red when I am using packages that are retired or have CVEs.
Today I encoutered an issue where cowlib package in its newest version 2.17.1 has low severity CVEs Security Advisories for cowlib | Hex
I don’t really want to make this check optional. If it is red for longer period of time, I will stop noticing new reports. What I would like is an allowlist mechanism where I can have an .hex_audit_ignore file where I can comment that I am aware of this low severity stuff and I am choosing to wait for the new version.
I know there is mix_audit. This one has a config. However, to run a mix task from a dependency, I need to compile that dep first. If a package was compromised, it is too late. mix hex.audit docs say to run it before any compilation.
I can also run mix_audit as an escript, but then it doesn’t read the config.
How do you deal with audits in CI? Do you work around it? Would you like to have an allowlist/ignorelist for mix hex.audit task?
Where Next?
Trending in Discussions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Bringing learning, work and compliance together since 1987.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixirconf-us
- #ai
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Bringing learning, work and compliance together since 1987.
**Building the future of software with AI, trust, and human connection.**
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 5- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
Lucassifoni
Currently my CI becomes red and blocking when mix hex.audit runs and has reports, but I added an ignore list in a text file specifically for the recent cowlib CVEs since there was a slight delay. I am not very satisfied with that, but have a cron that deletes the ignorelist weekly so there is no excessive “rot” and I get automatically reminded to check if cowlib updated, by the CI re-breaking soon later.
tomekowal
Thanks for your response. I am considering creating a feature request to hex team. The
mix hex.auditis clearly meant for CI, but its output depends on library maintainers, so we need a way to unblock the CI.maennchen
There’s an issue for that here: How to ignore advisories in mix hex.audit? · Issue #1194 · hexpm/hex · GitHub
Lucassifoni
I would love to brainstorm on this. I think at least supporting CVE identifier + date of ignore in the ignore list + an ignore staleness flag would be great. So we could put something like
mix hex.audit --max-ignore "3 day"in CI. But it opens a lot of questions. Maybe it would be worth talking of this with the EEF security / supply chain working group ?Edit : I missed your reply while replying @maennchen . Thank you for the issue link.
maennchen
Please add any ideas to the issue. We’ll probably not talk about this in the EEF Security WG call. That only happens once a month and this is likely to be addressed earlier.