[shahryarjb]

Summary

 .github/workflows/
+├── hex-audit.yml   # mix hex.audit → SARIF → code scanning; PRs, master, daily
 └── ci.yml          # + audit job: mix deps.audit, from the build cache
 mix.exs             # + {:mix_audit, "~> 2.1", only: [:dev, :test], runtime: false}
 mix.lock            # ash 3.37.0 → 3.37.2, ash_postgres 2.15.1 → 2.15.2, ash_sql 0.8.3 → 0.8.4

mix hex.audit (Hex 2.6) checks every locked release for retirement and for security advisories. Its SARIF report goes to code scanning, so findings show in the Security tab and on mix.lock in pull requests; the step still fails while one is open. It runs daily too, because an advisory can be published for a release that is already locked. GitHub's Dependabot alerts did not list any of the advisories below.

mix deps.audit (mix_audit) checks the lock against the elixir-security-advisories database. It needs the dependency compiled, so it runs in CI from the build cache.

Advisories on master, fixed by the bumps:

Package	Advisory	Severity	Fixed in
ash	EEF-CVE-2026-96581: an upsert on the primary key ignores attribute multitenancy	HIGH	3.37.2
ash	EEF-CVE-2026-114214: a through relationship loaded with limit 1 returns unrelated records	MEDIUM	3.37.1
ash_postgres	EEF-CVE-2026-115627: attribute multitenancy ignored on a join resource	MEDIUM	2.15.2
ash_postgres	EEF-CVE-2026-115635: a skipped upsert returns another tenant's record	MEDIUM	2.15.2

Evidence

• Before: mix hex.audit on master → Found packages with security advisories (ash, ash_postgres), exit 1.
• After: in a clean worktree resolving from Hex like CI: mix hex.audit --format sarif → exit 0; mix deps.audit → No vulnerabilities found.; MIX_ENV=test mix compile --warnings-as-errors, format check; mix test --warnings-as-errors → 3 passed.

Merge Danger

Door: two-way

Blast Radius: ci + patch bumps

Patch releases only; this repository's own lock (consumers resolve their own versions).

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.