corex-ui / corex
93%

DEFAULT BRANCH: main
Repo Added
Token LutuMv2S46aUF6A2R6alsYWo0NvXd5DsI regen
Build 661 Last
Files 192
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH main
branch: main
CHANGE BRANCH
x
Sync Branches

coverage: 93.231% (+0.004%) from 93.227%
1de608ce78ff49b9d21763f9d7edde38bf67354c

push

github

web-flow 
Harden redirect allowlists and fix security contributor docs (#135)

* docs: security policy, contributing accuracy, e2e showcase

Point vulnerability reports at GitHub Security Advisories, document
trusted HTML sinks, MCP, and the LiveView 1.1 pin versus the upstream
CVE floor. Fix CONTRIBUTING drift and state that e2e is a published
showcase, not a starter.

Co-authored-by: Karim Semmoud <karim-semmoud@users.noreply.github.com>

* fix: reject NUL, CR, and LF in redirect allowlists

After stripping leading C0/space, destinations that still contain NUL
or newlines cannot pass Corex.Url or the JS redirect helper, including
mailto header-injection patterns.

Co-authored-by: Karim Semmoud <karim-semmoud@users.noreply.github.com>

* chore: typescript dep, Hexdocs DataList group, e2e Dependabot

Add typescript as a direct devDependency so tsc resolves under pnpm,
list Corex.DataList once in Hexdocs, and watch e2e Mix deps.

Co-authored-by: Karim Semmoud <karim-semmoud@users.noreply.github.com>

* docs: avoid Hexdocs warnings in the unreleased changelog

Do not link Corex.Url as a module or SECURITY.md as a Hex extra.

Co-authored-by: Karim Semmoud <karim-semmoud@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Karim Semmoud <karim-semmoud@users.noreply.github.com>

7 of 7 new or added lines in 1 file covered. (100.0%)

8222 of 8819 relevant lines covered (93.23%)

36.61 hits per line

Relevant lines Covered
8819 RELEVANT LINES 8222 COVERED LINES
36.61 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
1de608ce... main Harden redirect allowlists and fix security contributor docs (#135) * docs: security policy, contributing accuracy, e2e showcase Point vulnerability reports at GitHub Security Advisories, document trusted HTML sinks, MCP, and the LiveView 1.1 pi... push web-flow github
93.23
24c0a5d8... main fix(hex): drop docs image symlinks and publish in docs env (#133) Remove Netoum logo copies and ExDoc assets maps so Hex tarballs cannot include an unsafe symlink. Host the footer logo on ImgBB. Run mix hex.publish in MIX_ENV=docs so ex_doc is av... push web-flow github
93.23
3c002a1e... main Release 0.2.2 (#132) * chore(release): lockstep packages to 0.2.2 Promote Unreleased notes into dated 0.2.2 changelogs for corex, corex_design, corex_mcp, and corex_new. Include the changelog on corex Hexdocs, raise a clear error when the nested... push web-flow github
93.23
e2e8a1dd... main Generate Design CSS in the asset pipeline, not mix compile (#126) * refactor: generate Design CSS in the asset pipeline, not mix compile Remove Mix.Tasks.Compile.CorexDesign and stop injecting :corex_design into compilers. Keep mix corex.design.... push web-flow github
93.23
675f864a... main chore(deps-dev): bump castore from 1.0.20 to 1.0.21 in /mcp (#120) Bumps [castore](https://github.com/elixir-mint/castore) from 1.0.20 to 1.0.21. - [Commits](https://github.com/elixir-mint/castore/compare/v1.0.20...v1.0.21) --- updated-dependenc... push web-flow github
93.23
4e061b66... main Bump postgrex to 0.22.4 (CVE-2026-66838) (#128) * fix(deps): bump postgrex to 0.22.4 for CVE-2026-66838 SQL injection via :comment on Postgrex.stream/4 (GHSA-3gww-3f36-2388). Raise the e2e and integration_test floor to >= 0.22.4. Co-authored-by... push web-flow github
93.23
694796eb... main feat: add Corex.Slider for single-thumb and range (#106) * feat: add Corex.Slider for single-thumb and range Uncontrolled Zag slider covering one thumb or N thumbs from the value list, with form gating, JS/server API, design CSS, and demo/e2e co... push web-flow github
93.22
23178a80... main chore(deps): batch Zag.js, Phoenix, LiveView, and Credo updates Squash the lockstep Zag.js 1.43.3 bump together with phoenix 1.8.13, phoenix_live_view 1.2.10, and oeditus_credo 0.11.2. Closes #108 Closes #109 Closes #110 Closes #111 Closes #112 ... push web-flow github
93.38
f371b94d... main chore(deps-dev): bump tidewave from 0.8.2 to 0.9.0 (#101) Bumps [tidewave](https://github.com/tidewave-ai/tidewave_phoenix) from 0.8.2 to 0.9.0. - [Changelog](https://github.com/tidewave-ai/tidewave_phoenix/blob/main/CHANGELOG.md) - [Commits](htt... push web-flow github
93.38
db6d9958... main Bump phoenix_live_view to 1.2.9 and fix LiveSocket types (#100) * Bump phoenix_live_view to 1.2.9 and accept public LiveSocket types. 1.2.8 is CVE-2026-64941; LiveView 1.2.x omits internal liveSocket.main from types, so canPushEvent now duck-typ... push web-flow github
93.38
See All Builds (660)