nova's rebar.config carries:
{overrides, [{override, cowboy, [{deps, [{cowlib, "2.16.1"}, {ranch, "2.2.0"}]}]}]}.cowlib 2.16.1 has advisory GHSA-g2wm-735q-3f56 (cookie request-header injection via cow_cookie:cookie/1). Because this is an override, downstream apps can only clear the advisory by adding their own top-level {cowlib, "~> 2.17"} (which supersedes the override) - bumping nova does not help.
Suggest bumping the override to a fixed cowlib (2.17.1+/2.18.0) once verified compatible with the pinned cowboy 2.15.0, so downstream apps inherit the fix. Low severity (advisory itself is low), but it means every Nova app currently ships a flagged transitive dep.
nova's rebar.config carries:
{overrides, [{override, cowboy, [{deps, [{cowlib, "2.16.1"}, {ranch, "2.2.0"}]}]}]}.cowlib 2.16.1 has advisory GHSA-g2wm-735q-3f56 (cookie request-header injection via cow_cookie:cookie/1). Because this is an override, downstream apps can only clear the advisory by adding their own top-level
{cowlib, "~> 2.17"}(which supersedes the override) - bumping nova does not help.Suggest bumping the override to a fixed cowlib (2.17.1+/2.18.0) once verified compatible with the pinned cowboy 2.15.0, so downstream apps inherit the fix. Low severity (advisory itself is low), but it means every Nova app currently ships a flagged transitive dep.