From 4923381aa86c5ba0b9aac11b5d8f8aac5e566579 Mon Sep 17 00:00:00 2001 From: Daniel Widgren Date: Tue, 30 Jun 2026 11:02:37 +0200 Subject: [PATCH 1/4] chore(otp): build on OTP 29 OTP 29 deprecates `catch Expr` (hard error under warnings_as_errors). - .tool-versions: erlang 29.0.2 (now tracked + un-ignored; drives CI via version-file) - ci.yml / nightly.yml: use version-file '.tool-versions' instead of hardcoded otp-version - meck ~> 0.9 -> ~> 1.2 (0.9 fails to compile on OTP 29) - test profile: nowarn_deprecated_catch (test teardown uses catch; src is catch-free) Verified green on OTP 29.0.2 against asobi's fixed branch: compile, eunit 223/0, dialyzer. NOTE: the asobi pin must be bumped to main once widgrensit/asobi#138 merges (asobi v2.0.8 kura). Draft until then. --- .github/workflows/ci.yml | 3 +-- .github/workflows/nightly.yml | 4 ++-- .gitignore | 1 - .tool-versions | 2 ++ rebar.config | 12 ++++++++++-- 5 files changed, 15 insertions(+), 7 deletions(-) create mode 100644 .tool-versions diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8ec3357..9cf0ad1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,8 +13,7 @@ jobs: contents: write pull-requests: write with: - otp-version: '28.0.1' - rebar3-version: '3.27.0' + version-file: '.tool-versions' enable-audit: true enable-dependency-submission: true enable-summary: true diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 59d1ae0..d6c2653 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -25,8 +25,8 @@ jobs: - uses: erlef/setup-beam@v1 with: - otp-version: '28.0.1' - rebar3-version: '3.27.0' + version-file: '.tool-versions' + version-type: strict - name: Cache _build uses: actions/cache@v4 diff --git a/.gitignore b/.gitignore index cd1f196..c581bf6 100644 --- a/.gitignore +++ b/.gitignore @@ -4,5 +4,4 @@ _checkouts/ rebar3.crashdump erl_crash.dump CLAUDE.md -.tool-versions doc/ diff --git a/.tool-versions b/.tool-versions new file mode 100644 index 0000000..745f93b --- /dev/null +++ b/.tool-versions @@ -0,0 +1,2 @@ +erlang 29.0.2 +rebar 3.27.0 diff --git a/rebar.config b/rebar.config index c65e170..3e1ff4a 100644 --- a/rebar.config +++ b/rebar.config @@ -34,10 +34,18 @@ ]} ]}, {test, [ - {erl_opts, [nowarn_export_all, nowarn_missing_spec, warnings_as_errors, {i, "test"}]}, + %% nowarn_deprecated_catch: OTP 29 deprecates `catch Expr`; test teardown + %% uses it for fire-and-forget cleanup. Suppress in tests only (src is catch-free). + {erl_opts, [ + nowarn_export_all, + nowarn_missing_spec, + nowarn_deprecated_catch, + warnings_as_errors, + {i, "test"} + ]}, {deps, [ {nova_test, {git, "https://github.com/novaframework/nova_test.git", {branch, "main"}}}, - {meck, "~> 0.9"}, + {meck, "~> 1.2"}, {proper, "~> 1.4"} ]}, {ct_opts, [{sys_config, "./config/dev_sys.config.src"}]}, From d2e4810386b4939087e92f9ea4630871f4166334 Mon Sep 17 00:00:00 2001 From: Daniel Widgren Date: Tue, 30 Jun 2026 11:55:30 +0200 Subject: [PATCH 2/4] ci: test eunit/ct on OTP 29 + drop stale cached meck --- .github/workflows/ci.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9cf0ad1..7f58e84 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,6 +14,12 @@ jobs: pull-requests: write with: version-file: '.tool-versions' + # version-file drives analysis jobs; the eunit/ct matrix needs otp-matrix + # (else it falls back to the otp-version default of 28). And meck is a + # test-only dep absent from rebar.lock, so a stale OTP-28-era meck is + # restored from cache and fails on OTP 29 - drop it so it re-resolves. + otp-matrix: '["29.0.2"]' + pre-test-command: 'rm -rf _build/test/lib/meck' enable-audit: true enable-dependency-submission: true enable-summary: true From 676eafd7041460bf157d1cad947cbb4797b70667 Mon Sep 17 00:00:00 2001 From: Daniel Widgren Date: Tue, 30 Jun 2026 12:05:15 +0200 Subject: [PATCH 3/4] chore(deps): bump asobi to OTP-29 main (kura v2.0.8) Flip the asobi pin to main now that widgrensit/asobi#138 is merged. Green on OTP 29.0.2: compile, eunit 223/0, dialyzer. --- rebar.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/rebar.lock b/rebar.lock index b020ba9..7877246 100644 --- a/rebar.lock +++ b/rebar.lock @@ -1,17 +1,17 @@ {"1.2.0", [{<<"asobi">>, {git,"https://github.com/widgrensit/asobi.git", - {ref,"0258d582ff8bcbcc6bf4464b5004dd37fcf90bfe"}}, + {ref,"92518c785d4b2fae1dc28dbf16c97dd9e5fb49d9"}}, 0}, {<<"backoff">>,{pkg,<<"backoff">>,<<"1.1.6">>},3}, {<<"cowboy">>,{pkg,<<"cowboy">>,<<"2.15.0">>},2}, - {<<"cowlib">>,{pkg,<<"cowlib">>,<<"2.17.1">>},3}, + {<<"cowlib">>,{pkg,<<"cowlib">>,<<"2.16.1">>},3}, {<<"erlydtl">>,{pkg,<<"erlydtl">>,<<"0.14.0">>},2}, {<<"jhn_stdlib">>,{pkg,<<"jhn_stdlib">>,<<"5.11.2">>},2}, {<<"jose">>,{pkg,<<"jose">>,<<"1.11.12">>},3}, {<<"kura">>, {git,"https://github.com/Taure/kura.git", - {ref,"64c487a02596e082ee0968f7f14b5ac8090ebc02"}}, + {ref,"fdb1abc5fdc0cc48c34b7d33fd8e0d6748c4a7d1"}}, 1}, {<<"kura_postgres">>, {git,"https://github.com/Taure/kura_postgres.git", @@ -37,7 +37,7 @@ {pkg_hash,[ {<<"backoff">>, <<"83B72ED2108BA1EE8F7D1C22E0B4A00CFE3593A67DBC792799E8CCE9F42F796B">>}, {<<"cowboy">>, <<"9CFE86ED7117BF045E10ADBEDB0170AF7BE57F2A3637E7BE143433D8DD267396">>}, - {<<"cowlib">>, <<"3E6053016D1AB245730F0AF688755476DCEDB1C25ED8FB5751F59A2BFDC0C9AF">>}, + {<<"cowlib">>, <<"318D385D55F657E9A5005838C4E426E13DCD724A691438384B6165A69687E531">>}, {<<"erlydtl">>, <<"964B2DC84F8C17ACFAA69C59BA129EF26AC45D2BA898C3C6AD9B5BDC8BA13CED">>}, {<<"jhn_stdlib">>, <<"785074F3CA368EAA8E9AF1592BC19AE9EF1F7AF30B2CD6456A6083173A8F5CCB">>}, {<<"jose">>, <<"06E62B467B61D3726CBC19E9B5489F7549C37993DE846DFB3EE8259F9ED208B3">>}, @@ -60,7 +60,7 @@ {pkg_hash_ext,[ {<<"backoff">>, <<"CF0CFFF8995FB20562F822E5CC47D8CCF664C5ECDC26A684CBE85C225F9D7C39">>}, {<<"cowboy">>, <<"179FB65140FB440A17B767AD53B755081506F9596C4DB5C49C0396D8C8643668">>}, - {<<"cowlib">>, <<"FF08BD17E6DD931445B18AF77315B9B5FE052407110964AD2588C686B57B5E3F">>}, + {<<"cowlib">>, <<"58F1E425A9E04176F1D30E20116F57C4E90EF0E187552E9741C465BDF4044F70">>}, {<<"erlydtl">>, <<"D80EC044CD8F58809C19D29AC5605BE09E955040911B644505E31E9DD8143431">>}, {<<"jhn_stdlib">>, <<"2329CD16DEE46704AAB6184D09508E59DBA31C4D3255271DBB7D34D115ECA508">>}, {<<"jose">>, <<"31E92B653E9210B696765CDD885437457DE1ADD2A9011D92F8CF63E4641BAB7B">>}, From 3a0933b3ac72998d4ef08d402a8658ea66dc279f Mon Sep 17 00:00:00 2001 From: Daniel Widgren Date: Tue, 30 Jun 2026 12:18:36 +0200 Subject: [PATCH 4/4] fix(deps): patch cowlib advisory via 2.17.1 (GHSA-g2wm-735q-3f56) cowboy 2.15.0 pins cowlib 2.16.1 transitively, which the GitHub Advisory DB now flags (LOW, CVE-2026-43969). Promote cowlib to the patched ~> 2.17 (hex cowboy 2.15.0 is compatible with cowlib 2.17.1, per asobi_engine). Real fix instead of an audit-ignore. eunit 223/0 on OTP 29. --- rebar.config | 5 ++++- rebar.lock | 6 +++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/rebar.config b/rebar.config index 3e1ff4a..150b414 100644 --- a/rebar.config +++ b/rebar.config @@ -12,7 +12,10 @@ {deps, [ {asobi, {git, "https://github.com/widgrensit/asobi.git", {branch, "main"}}}, - {luerl, "~> 1.5"} + {luerl, "~> 1.5"}, + %% Force the cowlib advisory fix (GHSA-g2wm-735q-3f56). cowboy 2.15.0 pins + %% cowlib 2.16.1 transitively; promote it to the patched 2.17.x. + {cowlib, "~> 2.17"} ]}. {relx, [ diff --git a/rebar.lock b/rebar.lock index 7877246..95a23a6 100644 --- a/rebar.lock +++ b/rebar.lock @@ -5,7 +5,7 @@ 0}, {<<"backoff">>,{pkg,<<"backoff">>,<<"1.1.6">>},3}, {<<"cowboy">>,{pkg,<<"cowboy">>,<<"2.15.0">>},2}, - {<<"cowlib">>,{pkg,<<"cowlib">>,<<"2.16.1">>},3}, + {<<"cowlib">>,{pkg,<<"cowlib">>,<<"2.17.1">>},0}, {<<"erlydtl">>,{pkg,<<"erlydtl">>,<<"0.14.0">>},2}, {<<"jhn_stdlib">>,{pkg,<<"jhn_stdlib">>,<<"5.11.2">>},2}, {<<"jose">>,{pkg,<<"jose">>,<<"1.11.12">>},3}, @@ -37,7 +37,7 @@ {pkg_hash,[ {<<"backoff">>, <<"83B72ED2108BA1EE8F7D1C22E0B4A00CFE3593A67DBC792799E8CCE9F42F796B">>}, {<<"cowboy">>, <<"9CFE86ED7117BF045E10ADBEDB0170AF7BE57F2A3637E7BE143433D8DD267396">>}, - {<<"cowlib">>, <<"318D385D55F657E9A5005838C4E426E13DCD724A691438384B6165A69687E531">>}, + {<<"cowlib">>, <<"3E6053016D1AB245730F0AF688755476DCEDB1C25ED8FB5751F59A2BFDC0C9AF">>}, {<<"erlydtl">>, <<"964B2DC84F8C17ACFAA69C59BA129EF26AC45D2BA898C3C6AD9B5BDC8BA13CED">>}, {<<"jhn_stdlib">>, <<"785074F3CA368EAA8E9AF1592BC19AE9EF1F7AF30B2CD6456A6083173A8F5CCB">>}, {<<"jose">>, <<"06E62B467B61D3726CBC19E9B5489F7549C37993DE846DFB3EE8259F9ED208B3">>}, @@ -60,7 +60,7 @@ {pkg_hash_ext,[ {<<"backoff">>, <<"CF0CFFF8995FB20562F822E5CC47D8CCF664C5ECDC26A684CBE85C225F9D7C39">>}, {<<"cowboy">>, <<"179FB65140FB440A17B767AD53B755081506F9596C4DB5C49C0396D8C8643668">>}, - {<<"cowlib">>, <<"58F1E425A9E04176F1D30E20116F57C4E90EF0E187552E9741C465BDF4044F70">>}, + {<<"cowlib">>, <<"FF08BD17E6DD931445B18AF77315B9B5FE052407110964AD2588C686B57B5E3F">>}, {<<"erlydtl">>, <<"D80EC044CD8F58809C19D29AC5605BE09E955040911B644505E31E9DD8143431">>}, {<<"jhn_stdlib">>, <<"2329CD16DEE46704AAB6184D09508E59DBA31C4D3255271DBB7D34D115ECA508">>}, {<<"jose">>, <<"31E92B653E9210B696765CDD885437457DE1ADD2A9011D92F8CF63E4641BAB7B">>},