hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Sec: Bump swoosh to version 1.28.0

Browse source 
Fixes:
  swoosh 1.16.12 VULNERABLE!
    EEF-CVE-2026-54893 (LOW)
    aka: CVE-2026-54893, GHSA-754j-98wh-57rf
    Email-derived URL path injection in the Swoosh Microsoft Graph adapter
    https://osv.dev/vulnerability/EEF-CVE-2026-54893
This commit is contained in:
Phantasm 2026-09-08 21:52:50 +02:00
commit 760daad8ef
No known key found for this signature in database
GPG key ID: 2669E588BCC634C8
3 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
mix.exs
View file

@ -169,7 +169,7 @@ defmodule Pleroma.Mixfile do
{:cors_plug, "~> 2.0"},
{:web_push_encryption, "~> 0.3.1"},
{:httpoison, "~> 3.0", override: true},
{:swoosh, "~> 1.16.12"},
{:swoosh, "~> 1.28"},
{:phoenix_swoosh, "~> 1.2"},
{:gen_smtp, "~> 0.15"},
{:mua, "~> 0.2.4"},