Skip to content

chore: require minato ~> 0.18 in the test profile - #172

Merged
Taure merged 1 commit into
mainfrom
chore/minato-0-18-5
Aug 6, 2026
Merged

chore: require minato ~> 0.18 in the test profile#172
Taure merged 1 commit into
mainfrom
chore/minato-0-18-5

Conversation

@Taure

@Taure Taure commented Aug 6, 2026

Copy link
Copy Markdown
Owner

Raises the test-profile floor from ~> 0.17 to ~> 0.18.

Resolution already picks the newest match, so in practice the suite has been running against 0.18.5 since it was published. What the change buys is the floor: ~> 0.17 still permits 0.17.x, whose pools fill eagerly on start. kura starts a repo per test module, which is exactly the shape that exhausted a server during the original swap. 0.18 defaults min_size to 1.

1411 tests, 0 failures.

One pre-existing flake, flagged not fixed. kura_through_tests:setup intermittently aborts with {badmatch,{error,{socket,closed}}} when the full suite runs; it passes on its own. It is not from this change - pinning minato 0.17.0 and running the same suite gives worse results:

minato result
0.17.0 pinned 1401 tests, 1 failure, 3 cancelled
0.18.5 1407-1411 tests, 0 failures, 1-2 cancelled

Worth its own issue: a module's setup should not depend on what ran before it.

The old ~> 0.17 range still allowed 0.17.x, whose pools fill eagerly. kura
starts a repo per test module, so that is the shape that exhausted a server
during the swap. 0.18 defaults min_size to 1 and grows on demand.
@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown

🟢 Code Coverage — 92.4%

2612 of 2826 lines covered.


🟡 ELP Lint — 1 warning

4 diagnostics found. See job logs for details.


ℹ️ 11 OTP CVEs auto-ignored (already fixed in running version)

These CVEs are patched in the installed OTP version but NVD data
has not been updated to reflect this. They are excluded from the
scan via an auto-generated .trivyignore.

CVE Details
CVE-2026-23943 Fixed in 28.4.1, running 28.4.1 — Pre-auth SSH DoS via unbounded zlib inflate
CVE-2026-23942 Fixed in 28.4.1, running 28.4.1 — SFTP root escape via component-agnostic prefix check in ssh_sftpd
CVE-2026-23941 Fixed in 28.4.1, running 28.4.1 — Request smuggling via first-wins Content-Length parsing in inets httpd
CVE-2026-21620 Fixed in 28.3.2, running 28.4.1 — TFTP Path Traversal
CVE-2016-1000107 Fixed in 28.0.4, running 28.4.1 — Httpd CGI Scripts Environment Variable Pollution AKA "httpoxy"
CVE-2025-58050 Fixed in 28.0.3, running 28.4.1 — Buffer Read Overflow on Regular Expressions with (*scs:) and (*ACCEPT)
CVE-2025-48038 Fixed in 28.0.3, running 28.4.1 — SSH Unverified File Handles can Cause Excessive Use of System Resources
CVE-2025-48039 Fixed in 28.0.3, running 28.4.1 — SSH Unverified Paths can Cause Excessive Use of System Resources
CVE-2025-48040 Fixed in 28.0.3, running 28.4.1 — SSH Malicious Key Exchange Messages may Lead to Excessive Resource Consumption
CVE-2025-48041 Fixed in 28.0.3, running 28.4.1 — SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles
CVE-2025-4748 Fixed in 28.0.1, running 28.4.1 — Absolute Path in Zip Module

@Taure
Taure merged commit bffb167 into main Aug 6, 2026
18 checks passed
@Taure
Taure deleted the chore/minato-0-18-5 branch August 6, 2026 11:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant