bedrock-kv / bedrock / a4287814f323b4f8c0927121384963dbc5159983

82%

push

github

Drop hackney (4 CVEs): object storage uses Req; audit deps in CI (bedrock-q31) (#142)

## Why

An OSV audit of `mix.lock` found our runtime HTTP client, **hackney
1.25.0**, carrying four CVEs (all first fixed in hackney 4.0.1):

- **CVE-2026-47069** — CRLF/header injection via unvalidated cookie
`domain`/`path` options
- **CVE-2026-47071** — SOCKS5 TLS upgrade ignores the caller's timeout
- **CVE-2026-47075** — CR/LF injection in query parameters
- **CVE-2026-47076** — SSRF allowlist bypass via percent-encoded host in
`hackney_url:normalize/2`

hackney reached us only through ex_aws (object storage), as its default
HTTP client.

## What

**hackney leaves the dependency tree entirely.** Rather than upgrading
it, object storage now uses **Req 0.7** through ex_aws's own
`ExAws.Request.Req` adapter (ex_aws bumped 2.6.1 → 2.7.0). The S3
backend injects the client per request, and callers can still override
`:http_client` through their backend config. Nine transitive packages
drop out of the lock (hackney, certifi, idna, ssl_verify_fun,
parse_trans, mimerl, h2, webtransport, quic), replaced by the maintained
Req/Finch/Mint stack.

This also made an intermediate fix unnecessary: the first commit
upgraded to hackney 4.7.4 and shimmed around an ex_aws 2.7 adapter
regression (its bundled hackney adapter crashes on bodiless HEAD
responses — caught by four red CAS tests against real MinIO). Req's
adapter operates on response structs with no tuple-shape fragility, so
the second commit deletes the shim along with hackney itself.

**`mix deps.audit` now runs in CI** — `mix_audit` added as a dev/test
dep with a CI step (one matrix cell), so future advisories fail the
build instead of accumulating silently.

## Known, deferred

The MinIO **test binary** (RELEASE.2024-09-13) has 21 known advisories,
but cannot currently be upgraded: `minio_server` 0.4.0 (latest) resolves
versions from a list bundled in the package, whose newest entry is that
same release, and rejects a... (continued)

0 of 1 new or added line in 1 file covered. (0.0%)

6064 of 7989 relevant lines covered (75.9%)

1087.71 hits per line