chore(deps): bump the CI image to Elixir 1.20.4 / OTP 29.0.6

graham commented

2026-09-06 16:22:27 -05:00

Owner

OTP 29.0.5 is flagged for the eleven high CVEs of the 2026-09-01 OTP security release — CVE-2026-75538 (signed length overflow in the inet TCP driver, reachable from an unauthenticated peer) and the httpd/inets set among them — and Elixir 1.20.3 for CVE-2026-75758.

Dockerfile.ci: ELIXIR_IMAGE → hexpm/elixir:1.20.4-erlang-29.0.6-debian-trixie-20260824-slim
Dockerfile.base: DEBIAN_VERSION trixie-20260518 → trixie-20260824, so the wgrib2 build stage stops shipping a four-month-old base
flake.lock: nixpkgs 2026-08-26 → 2026-09-05, whose beam29Packages is OTP 29.0.6 / Elixir 1.20.4

Not covered here

The application image's builder is git.mcintire.me/graham/elixir-base:latest (Dockerfile:7, Dockerfile.base:16), which this repo does not build. Its Elixir/OTP pin has to move in that repo for the release image to pick up 29.0.6 — this change covers the CI image and the base's Debian layer only.

Verification

In the updated shell: Elixir 1.20.4 on OTP 29, mix compile --warnings-as-errors clean, mix hex.audit clean, mix test 4899 passed / 12 failed — all 12 in Wgrib2Test, pre-existing and environmental: the Nix shell carries neither wgrib2 nor cdo (they live in prop-base), so those cannot pass locally on any toolchain.

OTP 29.0.5 is flagged for the eleven high CVEs of the 2026-09-01 OTP security release — CVE-2026-75538 (signed length overflow in the inet TCP driver, reachable from an unauthenticated peer) and the httpd/inets set among them — and Elixir 1.20.3 for CVE-2026-75758. - `Dockerfile.ci`: `ELIXIR_IMAGE` → `hexpm/elixir:1.20.4-erlang-29.0.6-debian-trixie-20260824-slim` - `Dockerfile.base`: `DEBIAN_VERSION` `trixie-20260518` → `trixie-20260824`, so the wgrib2 build stage stops shipping a four-month-old base - `flake.lock`: nixpkgs 2026-08-26 → 2026-09-05, whose `beam29Packages` is OTP 29.0.6 / Elixir 1.20.4 ## Not covered here The application image's builder is `git.mcintire.me/graham/elixir-base:latest` (`Dockerfile:7`, `Dockerfile.base:16`), which this repo does not build. Its Elixir/OTP pin has to move in that repo for the **release** image to pick up 29.0.6 — this change covers the CI image and the base's Debian layer only. ## Verification In the updated shell: Elixir 1.20.4 on OTP 29, `mix compile --warnings-as-errors` clean, `mix hex.audit` clean, `mix test` 4899 passed / 12 failed — all 12 in `Wgrib2Test`, pre-existing and environmental: the Nix shell carries neither `wgrib2` nor `cdo` (they live in prop-base), so those cannot pass locally on any toolchain.

graham added 1 commit

2026-09-06 16:22:27 -05:00

chore(deps): bump the CI image to Elixir 1.20.4 / OTP 29.0.6

skippy-bot/review Skippy review: clean — no open findings

Details

4b223f3cf3

OTP 29.0.5 is flagged for the eleven high CVEs of the 2026-09-01 OTP
security release -- CVE-2026-75538 (signed length overflow in the inet TCP
driver, reachable from an unauthenticated peer) and the httpd/inets set
among them -- and Elixir 1.20.3 for CVE-2026-75758.

- Dockerfile.ci: ELIXIR_IMAGE ->
  hexpm/elixir:1.20.4-erlang-29.0.6-debian-trixie-20260824-slim
- Dockerfile.base: DEBIAN_VERSION trixie-20260518 -> trixie-20260824, the
  newest trixie snapshot, so the wgrib2 build stage stops shipping a
  four-month-old base
- flake.lock: nixpkgs 2026-08-26 -> 2026-09-05, whose beam29Packages is
  OTP 29.0.6 / Elixir 1.20.4

The application image's builder is git.mcintire.me/graham/elixir-base:latest
(Dockerfile:7, and Dockerfile.base:16), which this repo does not build. Its
Elixir/OTP pin lives in that repo and has to move there for the release
image to pick up 29.0.6; this change covers the CI image and the base's
Debian layer only.

Verified in the updated shell: Elixir 1.20.4 on OTP 29, `mix compile
--warnings-as-errors` clean, `mix hex.audit` clean, `mix test` 4899 passed
with 12 failures -- all in Wgrib2Test, all pre-existing and environmental:
the Nix shell carries neither wgrib2 nor cdo (they live in prop-base), so
those tests cannot pass locally on any toolchain.

skippy-bot commented

2026-09-06 16:25:51 -05:00

First-time contributor

Clean. No findings.

Dockerfile.ci: tag verified live on Docker Hub (pushed 2026-09-01, amd64+arm64), and build.yaml builds the CI image with no ELIXIR_IMAGE override — the bump is what the test job actually runs.
Dockerfile.base: DEBIAN_VERSION only feeds the wgrib2-builder stage and stays inside trixie (same glibc symbol set — no linkage drift into the runtime image); wgrib2/g2c pins untouched.
flake.lock: dev-shell only — no CI workflow evaluates the flake (all docker).
The release-image caveat in the description is already handled by automation: graham/elixir-base re-locks nixpkgs and pushes latest nightly, and merging this PR triggers the build-base.yaml rebuild of prop-base:latest — so the deployed image follows 29.0.6 without a manual pin move.

Clean. No findings. - `Dockerfile.ci`: tag verified live on Docker Hub (pushed 2026-09-01, amd64+arm64), and `build.yaml` builds the CI image with no `ELIXIR_IMAGE` override — the bump is what the test job actually runs. - `Dockerfile.base`: `DEBIAN_VERSION` only feeds the `wgrib2-builder` stage and stays inside trixie (same glibc symbol set — no linkage drift into the runtime image); wgrib2/g2c pins untouched. - `flake.lock`: dev-shell only — no CI workflow evaluates the flake (all docker). - The release-image caveat in the description is already handled by automation: `graham/elixir-base` re-locks nixpkgs and pushes `latest` nightly, and merging this PR triggers the `build-base.yaml` rebuild of `prop-base:latest` — so the deployed image follows 29.0.6 without a manual pin move.

graham merged commit 5bead523ff into main

2026-09-06 16:28:44 -05:00

graham deleted branch chore/otp-29-0-6-bump

2026-09-06 16:28:44 -05:00

graham referenced this pull request from a commit

2026-09-06 16:28:44 -05:00

chore(deps): bump the CI image to Elixir 1.20.4 / OTP 29.0.6 (#9)

Rows
Columns

chore(deps): bump the CI image to Elixir 1.20.4 / OTP 29.0.6 #9

Not covered here

Verification