graham/aprs.me
Watch
1
0
Fork
You've already forked aprs.me
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

test: fix 0.0 pattern-match warning; chore: bump mint for CVE #38

Merged
graham merged 2 commits from fix/w16-bounds-test-warning into main 2026-09-21 16:32:20 -05:00
Conversation 1 Commits 2 Files changed 2 +5 -5
graham commented 2026-09-21 16:31:58 -05:00
Owner
Copy link

What

  • test: bounds_updater_test compared {:ok, %{... south: 0.0 ...}} via pattern match, which only accepts +0.0 and triggers the compiler warning pattern matching on 0.0 is equivalent to matching only on +0.0. Switched to == comparison (matches the style already used in the same describe block).
  • chore: bump mint 1.10.0 → 1.10.1 to fix EEF-CVE-2026-82672 (unvalidated chunk-size line tail → response smuggling). Main's CI is currently red on mix hex.audit for this advisory (run #284); this heals the gate.

Verification

  • mix test test/aprsme_web/live/map_live/bounds_updater_test.exs — 20/20, no warnings
  • Full suite: 2273 passed / 0 failed
  • Pre-commit hooks green: format, credo --strict, dialyzer, deps.audit
  • mix deps.audit — no vulnerabilities found
## What - `test:` bounds_updater_test compared `{:ok, %{... south: 0.0 ...}}` via pattern match, which only accepts `+0.0` and triggers the compiler warning `pattern matching on 0.0 is equivalent to matching only on +0.0`. Switched to `==` comparison (matches the style already used in the same describe block). - `chore:` bump mint 1.10.0 → 1.10.1 to fix EEF-CVE-2026-82672 (unvalidated chunk-size line tail → response smuggling). Main's CI is currently red on `mix hex.audit` for this advisory (run #284); this heals the gate. ## Verification - `mix test test/aprsme_web/live/map_live/bounds_updater_test.exs` — 20/20, no warnings - Full suite: 2273 passed / 0 failed - Pre-commit hooks green: format, credo --strict, dialyzer, deps.audit - `mix deps.audit` — no vulnerabilities found
mix hex.audit fails CI on mint 1.10.0 (unvalidated chunk-size line tail
enables response smuggling). 1.10.1 is the fixed release.
test: compare bounds result with == instead of matching on 0.0
All checks were successful
Elixir CI / Dialyzer (pull_request) Successful in 1m55s
Details
skippy-bot/review Skippy review: clean — no open findings
Details
Elixir CI / Build and test (pull_request) Successful in 3m47s
Details
Elixir CI / Build and Push Docker Image (pull_request) Has been skipped
Details
d992372de5
 
Pattern matching on 0.0 only accepts +0.0; the compiler warns. Use ==
comparison, which treats +0.0 and -0.0 as equal.
graham merged commit b24a740d8b into main 2026-09-21 16:32:20 -05:00
graham deleted branch fix/w16-bounds-test-warning 2026-09-21 16:32:21 -05:00
skippy-bot commented 2026-09-21 16:34:03 -05:00
First-time contributor
Copy link

Clean at d992372, no findings.

  • mix.lock: the mint 1.10.1 entry reproduces from hex. Registry checksum (field 4) and tarball sha256 (field 8) both match repo.hex.pm/tarballs/mint-1.10.1.tar, and finch 0.23.0's mint ~> 1.8 constraint admits it, so the bump resolves cleanly.
  • bounds_updater_test.exs: the == rewrite is equivalent-or-stricter (map equality now pins the exact key set too). No other literal 0.0 sits in a pattern position in lib/ or test/, so that warning class is gone repo-wide.

Heads-up: this PR is already merged to main as b24a740, and d992372 and main have identical trees. Nothing left to act on here.

Clean at d992372, no findings. - `mix.lock`: the mint 1.10.1 entry reproduces from hex. Registry checksum (field 4) and tarball sha256 (field 8) both match `repo.hex.pm/tarballs/mint-1.10.1.tar`, and `finch 0.23.0`'s `mint ~> 1.8` constraint admits it, so the bump resolves cleanly. - `bounds_updater_test.exs`: the `==` rewrite is equivalent-or-stricter (map equality now pins the exact key set too). No other literal `0.0` sits in a pattern position in `lib/` or `test/`, so that warning class is gone repo-wide. Heads-up: this PR is already merged to `main` as b24a740, and d992372 and main have identical trees. Nothing left to act on here. <!-- skippy-pr-review -->
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
graham/aprs.me!38
No description provided.